2005-01-06 23:35:40 +00:00
|
|
|
/*-
|
2017-11-20 19:43:44 +00:00
|
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
*
|
1994-05-24 10:09:53 +00:00
|
|
|
* Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
|
2007-01-08 20:37:02 +00:00
|
|
|
* The Regents of the University of California.
|
1994-05-24 10:09:53 +00:00
|
|
|
* (c) UNIX System Laboratories, Inc.
|
2007-01-08 20:37:02 +00:00
|
|
|
* Copyright (c) 2000-2001 Robert N. M. Watson.
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
1994-05-24 10:09:53 +00:00
|
|
|
* All or some portions of this file are derived from material licensed
|
|
|
|
* to the University of California by American Telephone and Telegraph
|
|
|
|
* Co. or Unix System Laboratories, Inc. and are reproduced herein with
|
|
|
|
* the permission of UNIX System Laboratories, Inc.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2016-09-15 13:16:20 +00:00
|
|
|
* 3. Neither the name of the University nor the names of its contributors
|
1994-05-24 10:09:53 +00:00
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* @(#)kern_prot.c 8.6 (Berkeley) 1/21/94
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* System calls related to processes and protection
|
|
|
|
*/
|
|
|
|
|
2003-06-11 00:56:59 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
2008-10-17 16:26:16 +00:00
|
|
|
#include "opt_inet.h"
|
|
|
|
#include "opt_inet6.h"
|
1997-12-16 17:40:42 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/systm.h>
|
2001-05-01 08:13:21 +00:00
|
|
|
#include <sys/acct.h>
|
2004-07-22 17:05:04 +00:00
|
|
|
#include <sys/kdb.h>
|
1998-11-10 09:16:29 +00:00
|
|
|
#include <sys/kernel.h>
|
2000-12-23 19:43:10 +00:00
|
|
|
#include <sys/lock.h>
|
2011-03-05 12:40:35 +00:00
|
|
|
#include <sys/loginclass.h>
|
2002-08-01 17:47:56 +00:00
|
|
|
#include <sys/malloc.h>
|
2001-05-01 08:13:21 +00:00
|
|
|
#include <sys/mutex.h>
|
2022-01-21 21:52:35 +00:00
|
|
|
#include <sys/ptrace.h>
|
2005-09-27 18:09:42 +00:00
|
|
|
#include <sys/refcount.h>
|
2001-11-12 18:56:49 +00:00
|
|
|
#include <sys/sx.h>
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
#include <sys/priv.h>
|
2002-02-23 11:12:57 +00:00
|
|
|
#include <sys/proc.h>
|
2022-05-28 17:52:17 +00:00
|
|
|
#ifdef COMPAT_43
|
2019-08-11 19:16:07 +00:00
|
|
|
#include <sys/sysent.h>
|
2022-05-28 17:52:17 +00:00
|
|
|
#endif
|
2001-05-01 08:13:21 +00:00
|
|
|
#include <sys/sysproto.h>
|
2001-12-02 15:07:10 +00:00
|
|
|
#include <sys/jail.h>
|
2011-03-31 18:12:04 +00:00
|
|
|
#include <sys/racct.h>
|
2018-04-20 13:08:04 +00:00
|
|
|
#include <sys/rctl.h>
|
2000-09-05 22:11:13 +00:00
|
|
|
#include <sys/resourcevar.h>
|
2002-03-22 19:57:41 +00:00
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
2006-07-06 21:32:20 +00:00
|
|
|
#include <sys/syscallsubr.h>
|
2000-06-05 18:30:55 +00:00
|
|
|
#include <sys/sysctl.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2011-02-25 10:11:01 +00:00
|
|
|
#ifdef REGRESSION
|
|
|
|
FEATURE(regression,
|
2012-01-08 18:48:36 +00:00
|
|
|
"Kernel support for interfaces necessary for regression testing (SECURITY RISK!)");
|
2011-02-25 10:11:01 +00:00
|
|
|
#endif
|
|
|
|
|
2006-02-06 00:32:33 +00:00
|
|
|
#include <security/audit/audit.h>
|
2006-10-22 11:52:19 +00:00
|
|
|
#include <security/mac/mac_framework.h>
|
2006-02-06 00:32:33 +00:00
|
|
|
|
1997-10-12 20:26:33 +00:00
|
|
|
static MALLOC_DEFINE(M_CRED, "cred", "credentials");
|
|
|
|
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
|
|
|
|
"BSD security policy");
|
2001-11-30 20:58:31 +00:00
|
|
|
|
2020-11-14 19:22:02 +00:00
|
|
|
static void crfree_final(struct ucred *cr);
|
2009-06-19 17:10:35 +00:00
|
|
|
static void crsetgroups_locked(struct ucred *cr, int ngrp,
|
|
|
|
gid_t *groups);
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getpid_args {
|
1994-05-24 10:09:53 +00:00
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getpid(struct thread *td, struct getpid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2001-09-12 08:38:13 +00:00
|
|
|
td->td_retval[0] = p->p_pid;
|
2004-06-11 11:16:26 +00:00
|
|
|
#if defined(COMPAT_43)
|
2019-08-11 19:16:07 +00:00
|
|
|
if (SV_PROC_FLAG(p, SV_AOUT))
|
|
|
|
td->td_retval[1] = kern_getppid(td);
|
1994-05-24 10:09:53 +00:00
|
|
|
#endif
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getppid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getppid(struct thread *td, struct getppid_args *uap)
|
2014-08-24 09:04:09 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
td->td_retval[0] = kern_getppid(td);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
kern_getppid(struct thread *td)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2018-11-16 17:07:54 +00:00
|
|
|
return (p->p_oppid);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
2001-12-06 21:58:47 +00:00
|
|
|
/*
|
2001-12-02 15:07:10 +00:00
|
|
|
* Get process group ID; note that POSIX getpgrp takes no parameter.
|
2000-03-28 07:16:37 +00:00
|
|
|
*/
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getpgrp_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getpgrp(struct thread *td, struct getpgrp_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_LOCK(p);
|
2001-09-12 08:38:13 +00:00
|
|
|
td->td_retval[0] = p->p_pgrp->pg_id;
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_UNLOCK(p);
|
1994-05-24 10:09:53 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2016-04-29 22:15:33 +00:00
|
|
|
/* Get an arbitrary pid's process group id */
|
1997-08-19 06:00:27 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct getpgid_args {
|
|
|
|
pid_t pid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getpgid(struct thread *td, struct getpgid_args *uap)
|
1997-08-19 06:00:27 +00:00
|
|
|
{
|
2003-04-25 20:09:31 +00:00
|
|
|
struct proc *p;
|
2002-03-22 21:02:02 +00:00
|
|
|
int error;
|
1998-12-13 07:07:51 +00:00
|
|
|
|
2002-02-23 11:12:57 +00:00
|
|
|
if (uap->pid == 0) {
|
2003-04-25 20:09:31 +00:00
|
|
|
p = td->td_proc;
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_LOCK(p);
|
2003-04-25 20:09:31 +00:00
|
|
|
} else {
|
|
|
|
p = pfind(uap->pid);
|
|
|
|
if (p == NULL)
|
|
|
|
return (ESRCH);
|
|
|
|
error = p_cansee(td, p);
|
|
|
|
if (error) {
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (error);
|
|
|
|
}
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2003-04-25 20:09:31 +00:00
|
|
|
td->td_retval[0] = p->p_pgrp->pg_id;
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (0);
|
1997-08-19 06:00:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2016-04-29 22:15:33 +00:00
|
|
|
* Get an arbitrary pid's session id.
|
1997-08-19 06:00:27 +00:00
|
|
|
*/
|
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct getsid_args {
|
|
|
|
pid_t pid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getsid(struct thread *td, struct getsid_args *uap)
|
2019-12-13 18:39:36 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
return (kern_getsid(td, uap->pid));
|
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
kern_getsid(struct thread *td, pid_t pid)
|
1997-08-19 06:00:27 +00:00
|
|
|
{
|
2003-04-25 20:09:31 +00:00
|
|
|
struct proc *p;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1998-12-13 07:07:51 +00:00
|
|
|
|
2019-12-13 18:39:36 +00:00
|
|
|
if (pid == 0) {
|
2003-04-25 20:09:31 +00:00
|
|
|
p = td->td_proc;
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_LOCK(p);
|
2003-04-25 20:09:31 +00:00
|
|
|
} else {
|
2019-12-13 18:39:36 +00:00
|
|
|
p = pfind(pid);
|
2003-04-25 20:09:31 +00:00
|
|
|
if (p == NULL)
|
|
|
|
return (ESRCH);
|
|
|
|
error = p_cansee(td, p);
|
|
|
|
if (error) {
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (error);
|
|
|
|
}
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2003-04-25 20:09:31 +00:00
|
|
|
td->td_retval[0] = p->p_session->s_sid;
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (0);
|
1997-08-19 06:00:27 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getuid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getuid(struct thread *td, struct getuid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
|
|
|
|
2002-03-22 22:32:04 +00:00
|
|
|
td->td_retval[0] = td->td_ucred->cr_ruid;
|
2004-06-11 11:16:26 +00:00
|
|
|
#if defined(COMPAT_43)
|
2002-03-22 22:32:04 +00:00
|
|
|
td->td_retval[1] = td->td_ucred->cr_uid;
|
1994-05-24 10:09:53 +00:00
|
|
|
#endif
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct geteuid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_geteuid(struct thread *td, struct geteuid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2002-03-22 22:32:04 +00:00
|
|
|
|
|
|
|
td->td_retval[0] = td->td_ucred->cr_uid;
|
1994-05-24 10:09:53 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getgid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getgid(struct thread *td, struct getgid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
|
|
|
|
2002-03-22 22:32:04 +00:00
|
|
|
td->td_retval[0] = td->td_ucred->cr_rgid;
|
2004-06-11 11:16:26 +00:00
|
|
|
#if defined(COMPAT_43)
|
2002-03-22 22:32:04 +00:00
|
|
|
td->td_retval[1] = td->td_ucred->cr_groups[0];
|
1994-05-24 10:09:53 +00:00
|
|
|
#endif
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get effective group ID. The "egid" is groups[0], and could be obtained
|
|
|
|
* via getgroups. This syscall exists because it is somewhat painful to do
|
|
|
|
* correctly in a library function.
|
|
|
|
*/
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-10-08 00:06:22 +00:00
|
|
|
struct getegid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getegid(struct thread *td, struct getegid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
|
|
|
|
2002-03-22 22:32:04 +00:00
|
|
|
td->td_retval[0] = td->td_ucred->cr_groups[0];
|
1994-05-24 10:09:53 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct getgroups_args {
|
2019-07-09 15:03:37 +00:00
|
|
|
int gidsetsize;
|
1994-05-24 10:09:53 +00:00
|
|
|
gid_t *gidset;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_getgroups(struct thread *td, struct getgroups_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2014-10-21 23:08:46 +00:00
|
|
|
struct ucred *cred;
|
2019-07-09 15:03:37 +00:00
|
|
|
int ngrp, error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-03-22 22:32:04 +00:00
|
|
|
cred = td->td_ucred;
|
2014-10-21 23:08:46 +00:00
|
|
|
ngrp = cred->cr_ngroups;
|
|
|
|
|
|
|
|
if (uap->gidsetsize == 0) {
|
|
|
|
error = 0;
|
|
|
|
goto out;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
2014-10-21 23:08:46 +00:00
|
|
|
if (uap->gidsetsize < ngrp)
|
2002-03-22 22:32:04 +00:00
|
|
|
return (EINVAL);
|
2014-10-21 23:08:46 +00:00
|
|
|
|
|
|
|
error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t));
|
|
|
|
out:
|
|
|
|
td->td_retval[0] = ngrp;
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1995-11-11 06:53:08 +00:00
|
|
|
struct setsid_args {
|
1995-10-08 00:06:22 +00:00
|
|
|
int dummy;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setsid(struct thread *td, struct setsid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2002-02-23 11:12:57 +00:00
|
|
|
struct pgrp *pgrp;
|
2001-09-01 19:04:37 +00:00
|
|
|
int error;
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
2002-02-23 11:12:57 +00:00
|
|
|
struct pgrp *newpgrp;
|
|
|
|
struct session *newsess;
|
|
|
|
|
|
|
|
error = 0;
|
|
|
|
pgrp = NULL;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2020-12-31 13:44:32 +00:00
|
|
|
newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
|
2008-10-23 15:53:51 +00:00
|
|
|
newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
2002-04-16 17:06:11 +00:00
|
|
|
sx_xlock(&proctree_lock);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
|
|
|
if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) {
|
|
|
|
if (pgrp != NULL)
|
|
|
|
PGRP_UNLOCK(pgrp);
|
2001-09-01 19:04:37 +00:00
|
|
|
error = EPERM;
|
2002-02-23 11:12:57 +00:00
|
|
|
} else {
|
|
|
|
(void)enterpgrp(p, p->p_pid, newpgrp, newsess);
|
2001-09-12 08:38:13 +00:00
|
|
|
td->td_retval[0] = p->p_pid;
|
2002-04-16 17:06:11 +00:00
|
|
|
newpgrp = NULL;
|
|
|
|
newsess = NULL;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
2002-02-23 11:12:57 +00:00
|
|
|
|
2002-04-16 17:06:11 +00:00
|
|
|
sx_xunlock(&proctree_lock);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
2020-12-31 13:44:32 +00:00
|
|
|
uma_zfree(pgrp_zone, newpgrp);
|
|
|
|
free(newsess, M_SESSION);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
2002-04-16 17:06:11 +00:00
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* set process group (setpgid/old setpgrp)
|
|
|
|
*
|
|
|
|
* caller does setpgid(targpid, targpgid)
|
|
|
|
*
|
|
|
|
* pid must be caller or child of caller (ESRCH)
|
|
|
|
* if a child
|
|
|
|
* pid must be in same session (EPERM)
|
|
|
|
* pid can't have done an exec (EACCES)
|
|
|
|
* if pgid != pid
|
|
|
|
* there must exist some pid in same session having pgid (EPERM)
|
|
|
|
* pid must not be session leader (EPERM)
|
|
|
|
*/
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setpgid_args {
|
2001-12-02 15:07:10 +00:00
|
|
|
int pid; /* target process id */
|
|
|
|
int pgid; /* target pgrp id */
|
1994-05-24 10:09:53 +00:00
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setpgid(struct thread *td, struct setpgid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *curp = td->td_proc;
|
2017-05-17 00:34:34 +00:00
|
|
|
struct proc *targp; /* target process */
|
|
|
|
struct pgrp *pgrp; /* target pgrp */
|
2001-04-12 19:39:00 +00:00
|
|
|
int error;
|
2002-02-23 11:12:57 +00:00
|
|
|
struct pgrp *newpgrp;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1996-12-19 13:28:47 +00:00
|
|
|
if (uap->pgid < 0)
|
|
|
|
return (EINVAL);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
|
|
|
error = 0;
|
|
|
|
|
2020-12-31 13:44:32 +00:00
|
|
|
newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
|
2002-02-23 11:12:57 +00:00
|
|
|
|
2002-04-16 17:06:11 +00:00
|
|
|
sx_xlock(&proctree_lock);
|
1994-05-24 10:09:53 +00:00
|
|
|
if (uap->pid != 0 && uap->pid != curp->p_pid) {
|
2002-02-23 11:12:57 +00:00
|
|
|
if ((targp = pfind(uap->pid)) == NULL) {
|
2001-09-01 19:04:37 +00:00
|
|
|
error = ESRCH;
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2002-02-23 11:12:57 +00:00
|
|
|
}
|
|
|
|
if (!inferior(targp)) {
|
|
|
|
PROC_UNLOCK(targp);
|
2002-02-27 10:38:14 +00:00
|
|
|
error = ESRCH;
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2004-07-23 04:26:49 +00:00
|
|
|
if ((error = p_cansee(td, targp))) {
|
2001-04-24 00:51:53 +00:00
|
|
|
PROC_UNLOCK(targp);
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
|
|
|
if (targp->p_pgrp == NULL ||
|
|
|
|
targp->p_session != curp->p_session) {
|
|
|
|
PROC_UNLOCK(targp);
|
2001-09-01 19:04:37 +00:00
|
|
|
error = EPERM;
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
|
|
|
if (targp->p_flag & P_EXEC) {
|
|
|
|
PROC_UNLOCK(targp);
|
2001-09-01 19:04:37 +00:00
|
|
|
error = EACCES;
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_UNLOCK(targp);
|
|
|
|
} else
|
1994-05-24 10:09:53 +00:00
|
|
|
targp = curp;
|
2001-04-24 00:51:53 +00:00
|
|
|
if (SESS_LEADER(targp)) {
|
2001-09-01 19:04:37 +00:00
|
|
|
error = EPERM;
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2001-12-02 15:07:10 +00:00
|
|
|
if (uap->pgid == 0)
|
1994-05-24 10:09:53 +00:00
|
|
|
uap->pgid = targp->p_pid;
|
2003-07-04 02:21:28 +00:00
|
|
|
if ((pgrp = pgfind(uap->pgid)) == NULL) {
|
|
|
|
if (uap->pgid == targp->p_pid) {
|
|
|
|
error = enterpgrp(targp, uap->pgid, newpgrp,
|
|
|
|
NULL);
|
|
|
|
if (error == 0)
|
|
|
|
newpgrp = NULL;
|
|
|
|
} else
|
2001-09-01 19:04:37 +00:00
|
|
|
error = EPERM;
|
2003-07-04 02:21:28 +00:00
|
|
|
} else {
|
|
|
|
if (pgrp == targp->p_pgrp) {
|
|
|
|
PGRP_UNLOCK(pgrp);
|
2002-04-16 17:06:11 +00:00
|
|
|
goto done;
|
2002-02-23 11:12:57 +00:00
|
|
|
}
|
2003-07-04 02:21:28 +00:00
|
|
|
if (pgrp->pg_id != targp->p_pid &&
|
|
|
|
pgrp->pg_session != curp->p_session) {
|
2002-02-23 11:12:57 +00:00
|
|
|
PGRP_UNLOCK(pgrp);
|
2003-07-04 02:21:28 +00:00
|
|
|
error = EPERM;
|
2002-02-23 11:12:57 +00:00
|
|
|
goto done;
|
2001-04-24 00:51:53 +00:00
|
|
|
}
|
2002-02-23 11:12:57 +00:00
|
|
|
PGRP_UNLOCK(pgrp);
|
|
|
|
error = enterthispgrp(targp, pgrp);
|
2001-09-01 19:04:37 +00:00
|
|
|
}
|
2002-02-23 11:12:57 +00:00
|
|
|
done:
|
2002-04-16 17:06:11 +00:00
|
|
|
sx_xunlock(&proctree_lock);
|
|
|
|
KASSERT((error == 0) || (newpgrp != NULL),
|
|
|
|
("setpgid failed and newpgrp is NULL"));
|
2020-12-31 13:44:32 +00:00
|
|
|
uma_zfree(pgrp_zone, newpgrp);
|
2001-09-01 19:04:37 +00:00
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1997-03-31 13:36:46 +00:00
|
|
|
/*
|
|
|
|
* Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
|
2001-02-06 12:05:58 +00:00
|
|
|
* compatible. It says that setting the uid/gid to euid/egid is a special
|
1997-03-31 13:36:46 +00:00
|
|
|
* case of "appropriate privilege". Once the rules are expanded out, this
|
|
|
|
* basically means that setuid(nnn) sets all three id's, in all permitted
|
|
|
|
* cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid())
|
|
|
|
* does not set the saved id - this is dangerous for traditional BSD
|
|
|
|
* programs. For this reason, we *really* do not want to set
|
|
|
|
* _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
|
|
|
|
*/
|
|
|
|
#define POSIX_APPENDIX_B_4_2_2
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setuid_args {
|
|
|
|
uid_t uid;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_setuid(struct thread *td, struct setuid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
|
|
|
uid_t uid;
|
2002-06-19 06:39:25 +00:00
|
|
|
struct uidinfo *uip;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-04-13 23:07:05 +00:00
|
|
|
uid = uap->uid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_UID(uid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
2002-06-19 06:39:25 +00:00
|
|
|
uip = uifind(uid);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
/*
|
|
|
|
* Copy credentials so other references do not see our changes.
|
|
|
|
*/
|
|
|
|
oldcred = crcopysafe(p, newcred);
|
2001-12-06 21:58:47 +00:00
|
|
|
|
2005-04-16 13:29:15 +00:00
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setuid(oldcred, uid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
1997-03-31 13:36:46 +00:00
|
|
|
/*
|
|
|
|
* See if we have "permission" by POSIX 1003.1 rules.
|
|
|
|
*
|
2001-12-02 15:07:10 +00:00
|
|
|
* Note that setuid(geteuid()) is a special case of
|
1997-03-31 13:36:46 +00:00
|
|
|
* "appropriate privileges" in appendix B.4.2.2. We need
|
2001-02-06 12:05:58 +00:00
|
|
|
* to use this clause to be compatible with traditional BSD
|
1997-03-31 13:36:46 +00:00
|
|
|
* semantics. Basically, it means that "setuid(xx)" sets all
|
|
|
|
* three id's (assuming you have privs).
|
|
|
|
*
|
|
|
|
* Notes on the logic. We do things in three steps.
|
|
|
|
* 1: We determine if the euid is going to change, and do EPERM
|
|
|
|
* right away. We unconditionally change the euid later if this
|
|
|
|
* test is satisfied, simplifying that part of the logic.
|
2001-12-02 15:07:10 +00:00
|
|
|
* 2: We determine if the real and/or saved uids are going to
|
1997-03-31 13:36:46 +00:00
|
|
|
* change. Determined by compile options.
|
|
|
|
* 3: Change euid last. (after tests in #2 for "appropriate privs")
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (uid != oldcred->cr_ruid && /* allow setuid(getuid()) */
|
1996-09-01 22:15:54 +00:00
|
|
|
#ifdef _POSIX_SAVED_IDS
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
uid != oldcred->cr_svuid && /* allow setuid(saved gid) */
|
1997-03-31 13:36:46 +00:00
|
|
|
#endif
|
|
|
|
#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
uid != oldcred->cr_uid && /* allow setuid(geteuid()) */
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETUID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
1997-03-31 13:36:46 +00:00
|
|
|
|
|
|
|
#ifdef _POSIX_SAVED_IDS
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
1997-03-31 13:36:46 +00:00
|
|
|
* Do we have "appropriate privileges" (are we root or uid == euid)
|
|
|
|
* If so, we are changing the real uid and/or saved uid.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
1996-09-01 22:15:54 +00:00
|
|
|
if (
|
1997-03-31 13:36:46 +00:00
|
|
|
#ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
uid == oldcred->cr_uid ||
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/* We are using privs. */
|
2018-12-11 19:32:16 +00:00
|
|
|
priv_check_cred(oldcred, PRIV_CRED_SETUID) == 0)
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
1997-03-31 13:36:46 +00:00
|
|
|
{
|
|
|
|
/*
|
2000-09-05 22:11:13 +00:00
|
|
|
* Set the real uid and transfer proc count to new user.
|
1997-03-31 13:36:46 +00:00
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (uid != oldcred->cr_ruid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_ruid(newcred, uip);
|
2000-09-05 22:11:13 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:36:46 +00:00
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Set saved uid
|
|
|
|
*
|
|
|
|
* XXX always set saved uid even if not _POSIX_SAVED_IDS, as
|
|
|
|
* the security of seteuid() depends on it. B.4.2.2 says it
|
|
|
|
* is important that we should do this.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (uid != oldcred->cr_svuid) {
|
|
|
|
change_svuid(newcred, uid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:36:46 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* In all permitted cases, we are changing the euid.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (uid != oldcred->cr_uid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_euid(newcred, uip);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1995-04-28 18:17:29 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#ifdef RACCT
|
|
|
|
racct_proc_ucred_changed(p, oldcred, newcred);
|
2018-04-20 13:08:04 +00:00
|
|
|
crhold(newcred);
|
|
|
|
#endif
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
#ifdef RCTL
|
|
|
|
rctl_proc_ucred_changed(p, newcred);
|
|
|
|
crfree(newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#endif
|
2002-06-19 06:39:25 +00:00
|
|
|
uifree(uip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
uifree(uip);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct seteuid_args {
|
|
|
|
uid_t euid;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_seteuid(struct thread *td, struct seteuid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
|
|
|
uid_t euid;
|
2002-06-19 06:39:25 +00:00
|
|
|
struct uidinfo *euip;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
euid = uap->euid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EUID(euid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
2002-06-19 06:39:25 +00:00
|
|
|
euip = uifind(euid);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
/*
|
|
|
|
* Copy credentials so other references do not see our changes.
|
|
|
|
*/
|
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_seteuid(oldcred, euid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (euid != oldcred->cr_ruid && /* allow seteuid(getuid()) */
|
|
|
|
euid != oldcred->cr_svuid && /* allow seteuid(saved uid) */
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETEUID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
2009-06-19 17:10:35 +00:00
|
|
|
* Everything's okay, do it.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (oldcred->cr_uid != euid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_euid(newcred, euip);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:41:49 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
2002-06-19 06:39:25 +00:00
|
|
|
uifree(euip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
uifree(euip);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setgid_args {
|
|
|
|
gid_t gid;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_setgid(struct thread *td, struct setgid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
|
|
|
gid_t gid;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
gid = uap->gid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_GID(gid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2001-12-06 21:58:47 +00:00
|
|
|
|
2005-04-16 13:29:15 +00:00
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setgid(oldcred, gid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
1997-03-31 13:36:46 +00:00
|
|
|
/*
|
|
|
|
* See if we have "permission" by POSIX 1003.1 rules.
|
|
|
|
*
|
|
|
|
* Note that setgid(getegid()) is a special case of
|
|
|
|
* "appropriate privileges" in appendix B.4.2.2. We need
|
2001-02-06 12:05:58 +00:00
|
|
|
* to use this clause to be compatible with traditional BSD
|
1997-03-31 13:36:46 +00:00
|
|
|
* semantics. Basically, it means that "setgid(xx)" sets all
|
|
|
|
* three id's (assuming you have privs).
|
|
|
|
*
|
|
|
|
* For notes on the logic here, see setuid() above.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (gid != oldcred->cr_rgid && /* allow setgid(getgid()) */
|
1996-09-01 22:15:54 +00:00
|
|
|
#ifdef _POSIX_SAVED_IDS
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
gid != oldcred->cr_svgid && /* allow setgid(saved gid) */
|
1997-03-31 13:36:46 +00:00
|
|
|
#endif
|
|
|
|
#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETGID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
1997-03-31 13:36:46 +00:00
|
|
|
|
1996-09-01 22:15:54 +00:00
|
|
|
#ifdef _POSIX_SAVED_IDS
|
1997-03-31 13:36:46 +00:00
|
|
|
/*
|
|
|
|
* Do we have "appropriate privileges" (are we root or gid == egid)
|
|
|
|
* If so, we are changing the real uid and saved gid.
|
|
|
|
*/
|
|
|
|
if (
|
|
|
|
#ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
gid == oldcred->cr_groups[0] ||
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/* We are using privs. */
|
2018-12-11 19:32:16 +00:00
|
|
|
priv_check_cred(oldcred, PRIV_CRED_SETGID) == 0)
|
1996-09-01 22:15:54 +00:00
|
|
|
#endif
|
1997-03-31 13:36:46 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Set real gid
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (oldcred->cr_rgid != gid) {
|
|
|
|
change_rgid(newcred, gid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:36:46 +00:00
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Set saved gid
|
|
|
|
*
|
|
|
|
* XXX always set saved gid even if not _POSIX_SAVED_IDS, as
|
|
|
|
* the security of setegid() depends on it. B.4.2.2 says it
|
|
|
|
* is important that we should do this.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (oldcred->cr_svgid != gid) {
|
|
|
|
change_svgid(newcred, gid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:36:46 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* In all cases permitted cases, we are changing the egid.
|
|
|
|
* Copy credentials so other references do not see our changes.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (oldcred->cr_groups[0] != gid) {
|
|
|
|
change_egid(newcred, gid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:36:46 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setegid_args {
|
|
|
|
gid_t egid;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_setegid(struct thread *td, struct setegid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
|
|
|
gid_t egid;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
egid = uap->egid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EGID(egid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setegid(oldcred, egid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (egid != oldcred->cr_rgid && /* allow setegid(getgid()) */
|
|
|
|
egid != oldcred->cr_svgid && /* allow setegid(saved gid) */
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETEGID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (oldcred->cr_groups[0] != egid) {
|
|
|
|
change_egid(newcred, egid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:41:49 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setgroups_args {
|
2019-07-09 15:03:37 +00:00
|
|
|
int gidsetsize;
|
1994-05-24 10:09:53 +00:00
|
|
|
gid_t *gidset;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_setgroups(struct thread *td, struct setgroups_args *uap)
|
2006-07-06 21:32:20 +00:00
|
|
|
{
|
2014-10-26 05:39:42 +00:00
|
|
|
gid_t smallgroups[XU_NGROUPS];
|
2014-10-26 06:04:09 +00:00
|
|
|
gid_t *groups;
|
2019-07-09 15:03:37 +00:00
|
|
|
int gidsetsize, error;
|
2006-07-06 21:32:20 +00:00
|
|
|
|
2014-10-26 05:39:42 +00:00
|
|
|
gidsetsize = uap->gidsetsize;
|
2019-07-09 15:03:37 +00:00
|
|
|
if (gidsetsize > ngroups_max + 1 || gidsetsize < 0)
|
2006-07-06 21:32:20 +00:00
|
|
|
return (EINVAL);
|
2014-10-26 06:04:09 +00:00
|
|
|
|
2014-10-26 05:39:42 +00:00
|
|
|
if (gidsetsize > XU_NGROUPS)
|
|
|
|
groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK);
|
|
|
|
else
|
|
|
|
groups = smallgroups;
|
2014-10-26 06:04:09 +00:00
|
|
|
|
2014-10-26 05:39:42 +00:00
|
|
|
error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t));
|
2014-10-26 06:04:09 +00:00
|
|
|
if (error == 0)
|
|
|
|
error = kern_setgroups(td, gidsetsize, groups);
|
|
|
|
|
2014-10-26 05:39:42 +00:00
|
|
|
if (gidsetsize > XU_NGROUPS)
|
|
|
|
free(groups, M_TEMP);
|
2009-06-19 17:10:35 +00:00
|
|
|
return (error);
|
2006-07-06 21:32:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
2006-07-06 21:32:20 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
1994-05-24 10:09:53 +00:00
|
|
|
int error;
|
|
|
|
|
2014-10-26 14:25:42 +00:00
|
|
|
MPASS(ngrp <= ngroups_max + 1);
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_GROUPSET(groups, ngrp);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
2009-06-19 17:10:35 +00:00
|
|
|
crextend(newcred, ngrp);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setgroups(oldcred, ngrp, groups);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
2018-12-11 19:32:16 +00:00
|
|
|
error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
|
2014-10-26 06:04:09 +00:00
|
|
|
if (ngrp == 0) {
|
1997-03-31 13:21:37 +00:00
|
|
|
/*
|
|
|
|
* setgroups(0, NULL) is a legitimate way of clearing the
|
|
|
|
* groups vector on non-BSD systems (which generally do not
|
|
|
|
* have the egid in the groups[0]). We risk security holes
|
|
|
|
* when running non-BSD software if we do not do the same.
|
|
|
|
*/
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
newcred->cr_ngroups = 1;
|
1997-03-31 13:21:37 +00:00
|
|
|
} else {
|
2009-06-19 17:10:35 +00:00
|
|
|
crsetgroups_locked(newcred, ngrp, groups);
|
1997-03-31 13:21:37 +00:00
|
|
|
}
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setreuid_args {
|
1995-06-15 22:32:03 +00:00
|
|
|
uid_t ruid;
|
|
|
|
uid_t euid;
|
1994-05-24 10:09:53 +00:00
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setreuid(struct thread *td, struct setreuid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
2001-12-02 15:07:10 +00:00
|
|
|
uid_t euid, ruid;
|
2002-06-19 06:39:25 +00:00
|
|
|
struct uidinfo *euip, *ruip;
|
2001-12-02 15:07:10 +00:00
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1995-06-15 22:32:03 +00:00
|
|
|
euid = uap->euid;
|
2001-12-02 15:07:10 +00:00
|
|
|
ruid = uap->ruid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EUID(euid);
|
|
|
|
AUDIT_ARG_RUID(ruid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
2002-06-19 06:39:25 +00:00
|
|
|
euip = uifind(euid);
|
|
|
|
ruip = uifind(ruid);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setreuid(oldcred, ruid, euid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
|
|
|
|
ruid != oldcred->cr_svuid) ||
|
|
|
|
(euid != (uid_t)-1 && euid != oldcred->cr_uid &&
|
|
|
|
euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) &&
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETREUID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_euid(newcred, euip);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:47:00 +00:00
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_ruid(newcred, ruip);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1995-04-27 19:23:24 +00:00
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) &&
|
|
|
|
newcred->cr_svuid != newcred->cr_uid) {
|
|
|
|
change_svuid(newcred, newcred->cr_uid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:47:00 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#ifdef RACCT
|
|
|
|
racct_proc_ucred_changed(p, oldcred, newcred);
|
2018-04-20 13:08:04 +00:00
|
|
|
crhold(newcred);
|
|
|
|
#endif
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
#ifdef RCTL
|
|
|
|
rctl_proc_ucred_changed(p, newcred);
|
|
|
|
crfree(newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#endif
|
2002-06-19 06:39:25 +00:00
|
|
|
uifree(ruip);
|
|
|
|
uifree(euip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
uifree(ruip);
|
|
|
|
uifree(euip);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setregid_args {
|
1995-06-15 22:32:03 +00:00
|
|
|
gid_t rgid;
|
|
|
|
gid_t egid;
|
1994-05-24 10:09:53 +00:00
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setregid(struct thread *td, struct setregid_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
2001-12-02 15:07:10 +00:00
|
|
|
gid_t egid, rgid;
|
|
|
|
int error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1995-06-15 22:32:03 +00:00
|
|
|
egid = uap->egid;
|
2001-12-02 15:07:10 +00:00
|
|
|
rgid = uap->rgid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EGID(egid);
|
|
|
|
AUDIT_ARG_RGID(rgid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setregid(oldcred, rgid, egid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
|
|
|
|
rgid != oldcred->cr_svgid) ||
|
|
|
|
(egid != (gid_t)-1 && egid != oldcred->cr_groups[0] &&
|
|
|
|
egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) &&
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETREGID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
2002-04-13 23:07:05 +00:00
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
|
|
|
|
change_egid(newcred, egid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:47:00 +00:00
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
|
|
|
|
change_rgid(newcred, rgid);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:47:00 +00:00
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) &&
|
|
|
|
newcred->cr_svgid != newcred->cr_groups[0]) {
|
|
|
|
change_svgid(newcred, newcred->cr_groups[0]);
|
1997-12-20 03:05:47 +00:00
|
|
|
setsugid(p);
|
1997-03-31 13:47:00 +00:00
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
2001-06-06 13:58:03 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
2000-01-16 16:34:26 +00:00
|
|
|
/*
|
2007-03-05 13:10:58 +00:00
|
|
|
* setresuid(ruid, euid, suid) is like setreuid except control over the saved
|
|
|
|
* uid is explicit.
|
2000-01-16 16:34:26 +00:00
|
|
|
*/
|
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct setresuid_args {
|
|
|
|
uid_t ruid;
|
|
|
|
uid_t euid;
|
|
|
|
uid_t suid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
/* ARGSUSED */
|
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setresuid(struct thread *td, struct setresuid_args *uap)
|
2000-01-16 16:34:26 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
2001-12-02 15:07:10 +00:00
|
|
|
uid_t euid, ruid, suid;
|
2002-06-19 06:39:25 +00:00
|
|
|
struct uidinfo *euip, *ruip;
|
2000-01-16 16:34:26 +00:00
|
|
|
int error;
|
|
|
|
|
|
|
|
euid = uap->euid;
|
2001-12-02 15:07:10 +00:00
|
|
|
ruid = uap->ruid;
|
2000-01-16 16:34:26 +00:00
|
|
|
suid = uap->suid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EUID(euid);
|
|
|
|
AUDIT_ARG_RUID(ruid);
|
|
|
|
AUDIT_ARG_SUID(suid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
2002-06-19 06:39:25 +00:00
|
|
|
euip = uifind(euid);
|
|
|
|
ruip = uifind(ruid);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setresuid(oldcred, ruid, euid, suid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
|
|
|
|
ruid != oldcred->cr_svuid &&
|
|
|
|
ruid != oldcred->cr_uid) ||
|
|
|
|
(euid != (uid_t)-1 && euid != oldcred->cr_ruid &&
|
|
|
|
euid != oldcred->cr_svuid &&
|
|
|
|
euid != oldcred->cr_uid) ||
|
|
|
|
(suid != (uid_t)-1 && suid != oldcred->cr_ruid &&
|
|
|
|
suid != oldcred->cr_svuid &&
|
|
|
|
suid != oldcred->cr_uid)) &&
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
2002-04-13 23:07:05 +00:00
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_euid(newcred, euip);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
|
2002-06-19 06:39:25 +00:00
|
|
|
change_ruid(newcred, ruip);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) {
|
|
|
|
change_svuid(newcred, suid);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#ifdef RACCT
|
|
|
|
racct_proc_ucred_changed(p, oldcred, newcred);
|
2018-04-20 13:08:04 +00:00
|
|
|
crhold(newcred);
|
|
|
|
#endif
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
#ifdef RCTL
|
|
|
|
rctl_proc_ucred_changed(p, newcred);
|
|
|
|
crfree(newcred);
|
2011-03-31 18:12:04 +00:00
|
|
|
#endif
|
2002-06-19 06:39:25 +00:00
|
|
|
uifree(ruip);
|
|
|
|
uifree(euip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
uifree(ruip);
|
|
|
|
uifree(euip);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
|
|
|
|
2000-01-16 16:34:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2007-03-05 13:10:58 +00:00
|
|
|
* setresgid(rgid, egid, sgid) is like setregid except control over the saved
|
|
|
|
* gid is explicit.
|
2000-01-16 16:34:26 +00:00
|
|
|
*/
|
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct setresgid_args {
|
|
|
|
gid_t rgid;
|
|
|
|
gid_t egid;
|
|
|
|
gid_t sgid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
/* ARGSUSED */
|
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_setresgid(struct thread *td, struct setresgid_args *uap)
|
2000-01-16 16:34:26 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
struct ucred *newcred, *oldcred;
|
2001-12-02 15:07:10 +00:00
|
|
|
gid_t egid, rgid, sgid;
|
2000-01-16 16:34:26 +00:00
|
|
|
int error;
|
|
|
|
|
|
|
|
egid = uap->egid;
|
2001-12-02 15:07:10 +00:00
|
|
|
rgid = uap->rgid;
|
2000-01-16 16:34:26 +00:00
|
|
|
sgid = uap->sgid;
|
2009-06-27 13:58:44 +00:00
|
|
|
AUDIT_ARG_EGID(egid);
|
|
|
|
AUDIT_ARG_RGID(rgid);
|
|
|
|
AUDIT_ARG_SGID(sgid);
|
2002-04-13 23:07:05 +00:00
|
|
|
newcred = crget();
|
|
|
|
PROC_LOCK(p);
|
2009-06-19 17:10:35 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
#ifdef MAC
|
2009-03-08 10:58:37 +00:00
|
|
|
error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid);
|
2005-04-16 13:29:15 +00:00
|
|
|
if (error)
|
|
|
|
goto fail;
|
|
|
|
#endif
|
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
|
|
|
|
rgid != oldcred->cr_svgid &&
|
|
|
|
rgid != oldcred->cr_groups[0]) ||
|
|
|
|
(egid != (gid_t)-1 && egid != oldcred->cr_rgid &&
|
|
|
|
egid != oldcred->cr_svgid &&
|
|
|
|
egid != oldcred->cr_groups[0]) ||
|
|
|
|
(sgid != (gid_t)-1 && sgid != oldcred->cr_rgid &&
|
|
|
|
sgid != oldcred->cr_svgid &&
|
|
|
|
sgid != oldcred->cr_groups[0])) &&
|
2018-12-11 19:32:16 +00:00
|
|
|
(error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID)) != 0)
|
2005-04-16 13:29:15 +00:00
|
|
|
goto fail;
|
2002-04-13 23:07:05 +00:00
|
|
|
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
|
|
|
|
change_egid(newcred, egid);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
|
|
|
|
change_rgid(newcred, rgid);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) {
|
|
|
|
change_svgid(newcred, sgid);
|
2000-01-16 16:34:26 +00:00
|
|
|
setsugid(p);
|
|
|
|
}
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_UNLOCK(p);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
crfree(oldcred);
|
2002-04-13 23:07:05 +00:00
|
|
|
return (0);
|
2005-04-16 13:29:15 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crfree(newcred);
|
|
|
|
return (error);
|
2000-01-16 16:34:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct getresuid_args {
|
|
|
|
uid_t *ruid;
|
|
|
|
uid_t *euid;
|
|
|
|
uid_t *suid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
/* ARGSUSED */
|
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_getresuid(struct thread *td, struct getresuid_args *uap)
|
2000-01-16 16:34:26 +00:00
|
|
|
{
|
2001-09-01 19:04:37 +00:00
|
|
|
struct ucred *cred;
|
2000-01-16 16:34:26 +00:00
|
|
|
int error1 = 0, error2 = 0, error3 = 0;
|
|
|
|
|
2002-03-27 05:39:23 +00:00
|
|
|
cred = td->td_ucred;
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->ruid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error1 = copyout(&cred->cr_ruid,
|
|
|
|
uap->ruid, sizeof(cred->cr_ruid));
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->euid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error2 = copyout(&cred->cr_uid,
|
|
|
|
uap->euid, sizeof(cred->cr_uid));
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->suid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error3 = copyout(&cred->cr_svuid,
|
|
|
|
uap->suid, sizeof(cred->cr_svuid));
|
2001-12-02 15:07:10 +00:00
|
|
|
return (error1 ? error1 : error2 ? error2 : error3);
|
2000-01-16 16:34:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct getresgid_args {
|
|
|
|
gid_t *rgid;
|
|
|
|
gid_t *egid;
|
|
|
|
gid_t *sgid;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
/* ARGSUSED */
|
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_getresgid(struct thread *td, struct getresgid_args *uap)
|
2000-01-16 16:34:26 +00:00
|
|
|
{
|
2001-09-01 19:04:37 +00:00
|
|
|
struct ucred *cred;
|
2000-01-16 16:34:26 +00:00
|
|
|
int error1 = 0, error2 = 0, error3 = 0;
|
|
|
|
|
2002-03-27 05:39:23 +00:00
|
|
|
cred = td->td_ucred;
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->rgid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error1 = copyout(&cred->cr_rgid,
|
|
|
|
uap->rgid, sizeof(cred->cr_rgid));
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->egid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error2 = copyout(&cred->cr_groups[0],
|
|
|
|
uap->egid, sizeof(cred->cr_groups[0]));
|
2000-01-16 16:34:26 +00:00
|
|
|
if (uap->sgid)
|
2002-06-29 01:50:25 +00:00
|
|
|
error3 = copyout(&cred->cr_svgid,
|
|
|
|
uap->sgid, sizeof(cred->cr_svgid));
|
2001-12-02 15:07:10 +00:00
|
|
|
return (error1 ? error1 : error2 ? error2 : error3);
|
2000-01-16 16:34:26 +00:00
|
|
|
}
|
|
|
|
|
1997-03-31 15:13:33 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
|
|
|
struct issetugid_args {
|
|
|
|
int dummy;
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
/* ARGSUSED */
|
|
|
|
int
|
2017-05-17 00:34:34 +00:00
|
|
|
sys_issetugid(struct thread *td, struct issetugid_args *uap)
|
1997-03-31 15:13:33 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
|
|
|
|
1997-03-31 15:13:33 +00:00
|
|
|
/*
|
|
|
|
* Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
|
|
|
|
* we use P_SUGID because we consider changing the owners as
|
|
|
|
* "tainting" as well.
|
|
|
|
* This is significant for procs that start as root and "become"
|
|
|
|
* a user without an exec - programs cannot know *everything*
|
|
|
|
* that libc *might* have put in their data segment.
|
|
|
|
*/
|
2001-09-12 08:38:13 +00:00
|
|
|
td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0;
|
1997-03-31 15:13:33 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2001-04-11 20:20:40 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys___setugid(struct thread *td, struct __setugid_args *uap)
|
2001-04-11 20:20:40 +00:00
|
|
|
{
|
|
|
|
#ifdef REGRESSION
|
2002-04-13 23:07:05 +00:00
|
|
|
struct proc *p;
|
2001-09-01 19:04:37 +00:00
|
|
|
|
2002-04-13 23:07:05 +00:00
|
|
|
p = td->td_proc;
|
2001-04-11 20:20:40 +00:00
|
|
|
switch (uap->flag) {
|
|
|
|
case 0:
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
|
|
|
p->p_flag &= ~P_SUGID;
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (0);
|
2001-04-11 20:20:40 +00:00
|
|
|
case 1:
|
2002-04-13 23:07:05 +00:00
|
|
|
PROC_LOCK(p);
|
|
|
|
p->p_flag |= P_SUGID;
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (0);
|
2001-04-11 20:20:40 +00:00
|
|
|
default:
|
2002-04-13 23:07:05 +00:00
|
|
|
return (EINVAL);
|
2001-04-11 20:20:40 +00:00
|
|
|
}
|
|
|
|
#else /* !REGRESSION */
|
2001-12-02 15:07:10 +00:00
|
|
|
|
2001-04-11 20:20:40 +00:00
|
|
|
return (ENOSYS);
|
2001-12-02 15:07:10 +00:00
|
|
|
#endif /* REGRESSION */
|
2001-04-11 20:20:40 +00:00
|
|
|
}
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Check if gid is a member of the group set.
|
|
|
|
*/
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2002-04-01 20:13:31 +00:00
|
|
|
groupmember(gid_t gid, struct ucred *cred)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2009-06-20 20:29:21 +00:00
|
|
|
int l;
|
|
|
|
int h;
|
|
|
|
int m;
|
|
|
|
|
|
|
|
if (cred->cr_groups[0] == gid)
|
|
|
|
return(1);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If gid was not our primary group, perform a binary search
|
|
|
|
* of the supplemental groups. This is possible because we
|
|
|
|
* sort the groups in crsetgroups().
|
|
|
|
*/
|
|
|
|
l = 1;
|
|
|
|
h = cred->cr_ngroups;
|
|
|
|
while (l < h) {
|
|
|
|
m = l + ((h - l) / 2);
|
|
|
|
if (cred->cr_groups[m] < gid)
|
|
|
|
l = m + 1;
|
|
|
|
else
|
|
|
|
h = m;
|
|
|
|
}
|
|
|
|
if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid))
|
|
|
|
return (1);
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2001-09-18 21:03:53 +00:00
|
|
|
/*
|
2001-12-02 15:07:10 +00:00
|
|
|
* Test the active securelevel against a given level. securelevel_gt()
|
|
|
|
* implements (securelevel > level). securelevel_ge() implements
|
|
|
|
* (securelevel >= level). Note that the logic is inverted -- these
|
|
|
|
* functions return EPERM on "success" and 0 on "failure".
|
2001-09-18 21:03:53 +00:00
|
|
|
*
|
2009-05-27 14:11:23 +00:00
|
|
|
* Due to care taken when setting the securelevel, we know that no jail will
|
|
|
|
* be less secure that its parent (or the physical system), so it is sufficient
|
|
|
|
* to test the current jail only.
|
|
|
|
*
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
* XXXRW: Possibly since this has to do with privilege, it should move to
|
|
|
|
* kern_priv.c.
|
2001-09-18 21:03:53 +00:00
|
|
|
*/
|
|
|
|
int
|
|
|
|
securelevel_gt(struct ucred *cr, int level)
|
|
|
|
{
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
return (cr->cr_prison->pr_securelevel > level ? EPERM : 0);
|
2001-09-18 21:03:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
securelevel_ge(struct ucred *cr, int level)
|
|
|
|
{
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0);
|
2001-09-18 21:03:53 +00:00
|
|
|
}
|
|
|
|
|
2001-10-09 21:40:30 +00:00
|
|
|
/*
|
2001-11-30 21:33:16 +00:00
|
|
|
* 'see_other_uids' determines whether or not visibility of processes
|
2001-12-02 15:07:10 +00:00
|
|
|
* and sockets with credentials holding different real uids is possible
|
2001-11-30 20:58:31 +00:00
|
|
|
* using a variety of system MIBs.
|
2001-12-02 15:07:10 +00:00
|
|
|
* XXX: data declarations should be together near the beginning of the file.
|
2001-10-09 21:40:30 +00:00
|
|
|
*/
|
2001-11-30 21:33:16 +00:00
|
|
|
static int see_other_uids = 1;
|
2002-01-16 06:55:30 +00:00
|
|
|
SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW,
|
2001-12-02 15:07:10 +00:00
|
|
|
&see_other_uids, 0,
|
2001-10-09 21:40:30 +00:00
|
|
|
"Unprivileged processes may see subjects/objects with different real uid");
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
* Determine if u1 "can see" the subject specified by u2, according to the
|
|
|
|
* 'see_other_uids' policy.
|
|
|
|
* Returns: 0 for permitted, ESRCH otherwise
|
|
|
|
* Locks: none
|
|
|
|
* References: *u1 and *u2 must not change during the call
|
|
|
|
* u1 may equal u2, in which case only one reference is required
|
|
|
|
*/
|
2016-07-27 20:34:09 +00:00
|
|
|
int
|
|
|
|
cr_canseeotheruids(struct ucred *u1, struct ucred *u2)
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) {
|
2018-12-11 19:32:16 +00:00
|
|
|
if (priv_check_cred(u1, PRIV_SEEOTHERUIDS) != 0)
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
return (ESRCH);
|
|
|
|
}
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2003-11-17 20:20:53 +00:00
|
|
|
/*
|
|
|
|
* 'see_other_gids' determines whether or not visibility of processes
|
|
|
|
* and sockets with credentials holding different real gids is possible
|
|
|
|
* using a variety of system MIBs.
|
|
|
|
* XXX: data declarations should be together near the beginning of the file.
|
|
|
|
*/
|
|
|
|
static int see_other_gids = 1;
|
|
|
|
SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW,
|
|
|
|
&see_other_gids, 0,
|
|
|
|
"Unprivileged processes may see subjects/objects with different real gid");
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Determine if u1 can "see" the subject specified by u2, according to the
|
|
|
|
* 'see_other_gids' policy.
|
|
|
|
* Returns: 0 for permitted, ESRCH otherwise
|
|
|
|
* Locks: none
|
|
|
|
* References: *u1 and *u2 must not change during the call
|
|
|
|
* u1 may equal u2, in which case only one reference is required
|
|
|
|
*/
|
2016-07-27 20:34:09 +00:00
|
|
|
int
|
|
|
|
cr_canseeothergids(struct ucred *u1, struct ucred *u2)
|
2003-11-17 20:20:53 +00:00
|
|
|
{
|
|
|
|
int i, match;
|
2020-09-01 22:12:32 +00:00
|
|
|
|
2003-11-17 20:20:53 +00:00
|
|
|
if (!see_other_gids) {
|
|
|
|
match = 0;
|
|
|
|
for (i = 0; i < u1->cr_ngroups; i++) {
|
|
|
|
if (groupmember(u1->cr_groups[i], u2))
|
|
|
|
match = 1;
|
|
|
|
if (match)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (!match) {
|
2018-12-11 19:32:16 +00:00
|
|
|
if (priv_check_cred(u1, PRIV_SEEOTHERGIDS) != 0)
|
2003-11-17 20:20:53 +00:00
|
|
|
return (ESRCH);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2017-05-23 16:59:24 +00:00
|
|
|
/*
|
|
|
|
* 'see_jail_proc' determines whether or not visibility of processes and
|
|
|
|
* sockets with credentials holding different jail ids is possible using a
|
|
|
|
* variety of system MIBs.
|
|
|
|
*
|
|
|
|
* XXX: data declarations should be together near the beginning of the file.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static int see_jail_proc = 1;
|
|
|
|
SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW,
|
|
|
|
&see_jail_proc, 0,
|
|
|
|
"Unprivileged processes may see subjects/objects with different jail ids");
|
|
|
|
|
|
|
|
/*-
|
|
|
|
* Determine if u1 "can see" the subject specified by u2, according to the
|
|
|
|
* 'see_jail_proc' policy.
|
|
|
|
* Returns: 0 for permitted, ESRCH otherwise
|
|
|
|
* Locks: none
|
|
|
|
* References: *u1 and *u2 must not change during the call
|
|
|
|
* u1 may equal u2, in which case only one reference is required
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
cr_canseejailproc(struct ucred *u1, struct ucred *u2)
|
|
|
|
{
|
|
|
|
if (u1->cr_uid == 0)
|
|
|
|
return (0);
|
|
|
|
return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0);
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Determine if u1 "can see" the subject specified by u2.
|
2001-03-28 20:50:15 +00:00
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
|
|
|
* Locks: none
|
2001-12-02 15:07:10 +00:00
|
|
|
* References: *u1 and *u2 must not change during the call
|
2001-03-28 20:50:15 +00:00
|
|
|
* u1 may equal u2, in which case only one reference is required
|
|
|
|
*/
|
|
|
|
int
|
2001-09-20 21:45:31 +00:00
|
|
|
cr_cansee(struct ucred *u1, struct ucred *u2)
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
{
|
2001-02-21 06:39:57 +00:00
|
|
|
int error;
|
1999-11-21 19:03:20 +00:00
|
|
|
|
2001-03-28 20:50:15 +00:00
|
|
|
if ((error = prison_check(u1, u2)))
|
2001-02-21 06:39:57 +00:00
|
|
|
return (error);
|
2002-07-31 00:48:24 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_cred_check_visible(u1, u2)))
|
2002-07-31 00:48:24 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeotheruids(u1, u2)))
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
return (error);
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeothergids(u1, u2)))
|
2003-11-17 20:20:53 +00:00
|
|
|
return (error);
|
2017-05-23 16:59:24 +00:00
|
|
|
if ((error = cr_canseejailproc(u1, u2)))
|
|
|
|
return (error);
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-05-19 00:14:50 +00:00
|
|
|
* Determine if td "can see" the subject specified by p.
|
2001-08-27 16:01:52 +00:00
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
2002-05-19 00:14:50 +00:00
|
|
|
* Locks: Sufficient locks to protect p->p_ucred must be held. td really
|
|
|
|
* should be curthread.
|
|
|
|
* References: td and p must be valid for the lifetime of the call
|
2001-08-27 16:01:52 +00:00
|
|
|
*/
|
2001-07-05 17:10:46 +00:00
|
|
|
int
|
2002-05-19 00:14:50 +00:00
|
|
|
p_cansee(struct thread *td, struct proc *p)
|
2001-03-28 20:50:15 +00:00
|
|
|
{
|
2001-09-20 21:45:31 +00:00
|
|
|
/* Wrap cr_cansee() for all functionality. */
|
2002-05-19 00:14:50 +00:00
|
|
|
KASSERT(td == curthread, ("%s: td not curthread", __func__));
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
2022-01-21 15:29:17 +00:00
|
|
|
|
|
|
|
if (td->td_proc == p)
|
|
|
|
return (0);
|
2002-05-19 00:14:50 +00:00
|
|
|
return (cr_cansee(td->td_ucred, p->p_ucred));
|
2001-03-28 20:50:15 +00:00
|
|
|
}
|
|
|
|
|
2003-09-14 07:22:38 +00:00
|
|
|
/*
|
|
|
|
* 'conservative_signals' prevents the delivery of a broad class of
|
|
|
|
* signals by unprivileged processes to processes that have changed their
|
|
|
|
* credentials since the last invocation of execve(). This can prevent
|
|
|
|
* the leakage of cached information or retained privileges as a result
|
|
|
|
* of a common class of signal-related vulnerabilities. However, this
|
|
|
|
* may interfere with some applications that expect to be able to
|
|
|
|
* deliver these signals to peer processes after having given up
|
|
|
|
* privilege.
|
|
|
|
*/
|
|
|
|
static int conservative_signals = 1;
|
|
|
|
SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW,
|
|
|
|
&conservative_signals, 0, "Unprivileged processes prevented from "
|
|
|
|
"sending certain signals to processes whose credentials have changed");
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-01-06 00:20:12 +00:00
|
|
|
* Determine whether cred may deliver the specified signal to proc.
|
|
|
|
* Returns: 0 for permitted, an errno value otherwise.
|
|
|
|
* Locks: A lock must be held for proc.
|
|
|
|
* References: cred and proc must be valid for the lifetime of the call.
|
2001-04-12 02:38:08 +00:00
|
|
|
*/
|
|
|
|
int
|
2005-02-13 17:37:20 +00:00
|
|
|
cr_cansignal(struct ucred *cred, struct proc *proc, int signum)
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
{
|
2001-08-28 16:35:33 +00:00
|
|
|
int error;
|
2001-10-11 22:49:27 +00:00
|
|
|
|
2002-05-19 00:14:50 +00:00
|
|
|
PROC_LOCK_ASSERT(proc, MA_OWNED);
|
2001-04-12 02:38:08 +00:00
|
|
|
/*
|
2002-01-06 00:20:12 +00:00
|
|
|
* Jail semantics limit the scope of signalling to proc in the
|
|
|
|
* same jail as cred, if cred is in jail.
|
2001-04-12 02:38:08 +00:00
|
|
|
*/
|
2002-01-06 00:20:12 +00:00
|
|
|
error = prison_check(cred, proc->p_ucred);
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
2002-07-31 00:48:24 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_proc_check_signal(cred, proc, signum)))
|
2002-07-31 00:48:24 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeotheruids(cred, proc->p_ucred)))
|
2003-11-17 20:20:53 +00:00
|
|
|
return (error);
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeothergids(cred, proc->p_ucred)))
|
2001-02-21 06:39:57 +00:00
|
|
|
return (error);
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
|
2001-04-12 02:38:08 +00:00
|
|
|
/*
|
2001-08-27 16:01:52 +00:00
|
|
|
* UNIX signal semantics depend on the status of the P_SUGID
|
|
|
|
* bit on the target process. If the bit is set, then additional
|
|
|
|
* restrictions are placed on the set of available signals.
|
2001-04-12 02:38:08 +00:00
|
|
|
*/
|
2005-02-13 17:37:20 +00:00
|
|
|
if (conservative_signals && (proc->p_flag & P_SUGID)) {
|
2001-04-12 02:38:08 +00:00
|
|
|
switch (signum) {
|
|
|
|
case 0:
|
|
|
|
case SIGKILL:
|
|
|
|
case SIGINT:
|
|
|
|
case SIGTERM:
|
2003-09-14 07:22:38 +00:00
|
|
|
case SIGALRM:
|
2001-04-12 02:38:08 +00:00
|
|
|
case SIGSTOP:
|
|
|
|
case SIGTTIN:
|
|
|
|
case SIGTTOU:
|
|
|
|
case SIGTSTP:
|
|
|
|
case SIGHUP:
|
|
|
|
case SIGUSR1:
|
|
|
|
case SIGUSR2:
|
2001-08-28 16:35:33 +00:00
|
|
|
/*
|
|
|
|
* Generally, permit job and terminal control
|
|
|
|
* signals.
|
|
|
|
*/
|
2001-04-12 02:38:08 +00:00
|
|
|
break;
|
|
|
|
default:
|
2002-01-06 00:20:12 +00:00
|
|
|
/* Not permitted without privilege. */
|
2018-12-11 19:32:16 +00:00
|
|
|
error = priv_check_cred(cred, PRIV_SIGNAL_SUGID);
|
2001-04-12 02:38:08 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
}
|
2001-04-13 14:33:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2001-08-27 16:01:52 +00:00
|
|
|
* Generally, the target credential's ruid or svuid must match the
|
2001-04-13 14:33:45 +00:00
|
|
|
* subject credential's ruid or euid.
|
|
|
|
*/
|
2002-01-06 00:20:12 +00:00
|
|
|
if (cred->cr_ruid != proc->p_ucred->cr_ruid &&
|
|
|
|
cred->cr_ruid != proc->p_ucred->cr_svuid &&
|
|
|
|
cred->cr_uid != proc->p_ucred->cr_ruid &&
|
|
|
|
cred->cr_uid != proc->p_ucred->cr_svuid) {
|
2018-12-11 19:32:16 +00:00
|
|
|
error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED);
|
2001-04-13 14:33:45 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
}
|
|
|
|
|
2001-12-02 15:07:10 +00:00
|
|
|
return (0);
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-05-19 00:14:50 +00:00
|
|
|
* Determine whether td may deliver the specified signal to p.
|
2002-01-06 00:20:12 +00:00
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
2002-05-19 00:14:50 +00:00
|
|
|
* Locks: Sufficient locks to protect various components of td and p
|
|
|
|
* must be held. td must be curthread, and a lock must be
|
|
|
|
* held for p.
|
|
|
|
* References: td and p must be valid for the lifetime of the call
|
2002-01-06 00:20:12 +00:00
|
|
|
*/
|
|
|
|
int
|
2005-02-13 17:37:20 +00:00
|
|
|
p_cansignal(struct thread *td, struct proc *p, int signum)
|
2002-01-06 00:20:12 +00:00
|
|
|
{
|
|
|
|
|
2002-05-19 00:14:50 +00:00
|
|
|
KASSERT(td == curthread, ("%s: td not curthread", __func__));
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
|
|
|
if (td->td_proc == p)
|
2002-01-06 00:20:12 +00:00
|
|
|
return (0);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* UNIX signalling semantics require that processes in the same
|
|
|
|
* session always be able to deliver SIGCONT to one another,
|
|
|
|
* overriding the remaining protections.
|
|
|
|
*/
|
2002-05-19 00:14:50 +00:00
|
|
|
/* XXX: This will require an additional lock of some sort. */
|
|
|
|
if (signum == SIGCONT && td->td_proc->p_session == p->p_session)
|
2002-01-06 00:20:12 +00:00
|
|
|
return (0);
|
2005-03-03 16:57:55 +00:00
|
|
|
/*
|
2005-03-18 11:08:55 +00:00
|
|
|
* Some compat layers use SIGTHR and higher signals for
|
|
|
|
* communication between different kernel threads of the same
|
|
|
|
* process, so that they expect that it's always possible to
|
|
|
|
* deliver them, even for suid applications where cr_cansignal() can
|
2005-03-03 16:57:55 +00:00
|
|
|
* deny such ability for security consideration. It should be
|
|
|
|
* pretty safe to do since the only way to create two processes
|
|
|
|
* with the same p_leader is via rfork(2).
|
|
|
|
*/
|
2005-03-18 13:33:18 +00:00
|
|
|
if (td->td_proc->p_leader != NULL && signum >= SIGTHR &&
|
|
|
|
signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader)
|
2005-03-03 16:57:55 +00:00
|
|
|
return (0);
|
2002-01-06 00:20:12 +00:00
|
|
|
|
2005-02-13 17:37:20 +00:00
|
|
|
return (cr_cansignal(td->td_ucred, p, signum));
|
2002-01-06 00:20:12 +00:00
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-05-19 00:14:50 +00:00
|
|
|
* Determine whether td may reschedule p.
|
2001-08-28 16:35:33 +00:00
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
2002-05-19 00:14:50 +00:00
|
|
|
* Locks: Sufficient locks to protect various components of td and p
|
|
|
|
* must be held. td must be curthread, and a lock must
|
|
|
|
* be held for p.
|
|
|
|
* References: td and p must be valid for the lifetime of the call
|
2001-08-27 16:01:52 +00:00
|
|
|
*/
|
2001-07-05 17:10:46 +00:00
|
|
|
int
|
2002-05-19 00:14:50 +00:00
|
|
|
p_cansched(struct thread *td, struct proc *p)
|
1999-11-21 19:03:20 +00:00
|
|
|
{
|
2001-02-21 06:39:57 +00:00
|
|
|
int error;
|
1999-11-21 19:03:20 +00:00
|
|
|
|
2002-05-19 00:14:50 +00:00
|
|
|
KASSERT(td == curthread, ("%s: td not curthread", __func__));
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
|
|
|
if (td->td_proc == p)
|
1999-11-21 19:03:20 +00:00
|
|
|
return (0);
|
2002-05-19 00:14:50 +00:00
|
|
|
if ((error = prison_check(td->td_ucred, p->p_ucred)))
|
2001-02-21 06:39:57 +00:00
|
|
|
return (error);
|
2002-07-31 00:48:24 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_proc_check_sched(td->td_ucred, p)))
|
2002-07-31 00:48:24 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
return (error);
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
|
2003-11-17 20:20:53 +00:00
|
|
|
return (error);
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid &&
|
|
|
|
td->td_ucred->cr_uid != p->p_ucred->cr_ruid) {
|
2007-06-12 00:12:01 +00:00
|
|
|
error = priv_check(td, PRIV_SCHED_DIFFCRED);
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
return (0);
|
1999-11-21 19:03:20 +00:00
|
|
|
}
|
|
|
|
|
2018-11-27 17:51:50 +00:00
|
|
|
/*
|
|
|
|
* Handle getting or setting the prison's unprivileged_proc_debug
|
|
|
|
* value.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
sysctl_unprivileged_proc_debug(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
int error, val;
|
|
|
|
|
2020-12-27 04:25:02 +00:00
|
|
|
val = prison_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG);
|
2018-11-27 17:51:50 +00:00
|
|
|
error = sysctl_handle_int(oidp, &val, 0, req);
|
|
|
|
if (error != 0 || req->newptr == NULL)
|
|
|
|
return (error);
|
2020-12-27 04:25:02 +00:00
|
|
|
if (val != 0 && val != 1)
|
|
|
|
return (EINVAL);
|
|
|
|
prison_set_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG, val);
|
|
|
|
return (0);
|
2018-11-27 17:51:50 +00:00
|
|
|
}
|
|
|
|
|
2001-08-27 16:01:52 +00:00
|
|
|
/*
|
2001-12-03 19:10:21 +00:00
|
|
|
* The 'unprivileged_proc_debug' flag may be used to disable a variety of
|
|
|
|
* unprivileged inter-process debugging services, including some procfs
|
|
|
|
* functionality, ptrace(), and ktrace(). In the past, inter-process
|
|
|
|
* debugging has been involved in a variety of security problems, and sites
|
|
|
|
* not requiring the service might choose to disable it when hardening
|
|
|
|
* systems.
|
2001-08-27 16:01:52 +00:00
|
|
|
*/
|
2018-11-27 17:51:50 +00:00
|
|
|
SYSCTL_PROC(_security_bsd, OID_AUTO, unprivileged_proc_debug,
|
2020-02-26 14:26:36 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_SECURE |
|
|
|
|
CTLFLAG_MPSAFE, 0, 0, sysctl_unprivileged_proc_debug, "I",
|
o Introduce new kern.security sysctl tree for kernel security policy
MIB entries.
o Relocate kern.suser_permitted to kern.security.suser_permitted.
o Introduce new kern.security.unprivileged_procdebug_permitted, which
(when set to 0) prevents processes without privilege from performing
a variety of inter-process debugging activities. The default is 1,
to provide current behavior.
This feature allows "hardened" systems to disable access to debugging
facilities, which have been associated with a number of past security
vulnerabilities. Previously, while procfs could be unmounted, other
in-kernel facilities (such as ptrace()) were still available. This
setting should not be modified on normal development systems, as it
will result in frustration. Some utilities respond poorly to
failing to get the debugging access they require, and error response
by these utilities may be improved in the future in the name of
beautification.
Note that there are currently some odd interactions with some
facilities, which will need to be resolved before this should be used
in production, including odd interactions with truss and ktrace.
Note also that currently, tracing is permitted on the current process
regardless of this flag, for compatibility with previous
authorization code in various facilities, but that will probably
change (and resolve the odd interactions).
Obtained from: TrustedBSD Project
2001-07-31 15:48:21 +00:00
|
|
|
"Unprivileged processes may use process debugging facilities");
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-05-19 00:14:50 +00:00
|
|
|
* Determine whether td may debug p.
|
2001-08-28 16:35:33 +00:00
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
2002-05-19 00:14:50 +00:00
|
|
|
* Locks: Sufficient locks to protect various components of td and p
|
|
|
|
* must be held. td must be curthread, and a lock must
|
|
|
|
* be held for p.
|
|
|
|
* References: td and p must be valid for the lifetime of the call
|
2001-08-27 16:01:52 +00:00
|
|
|
*/
|
2001-07-05 17:10:46 +00:00
|
|
|
int
|
2002-05-19 00:14:50 +00:00
|
|
|
p_candebug(struct thread *td, struct proc *p)
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
{
|
2023-01-31 00:15:04 +00:00
|
|
|
int error, grpsubset, i, uidsubset;
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
|
2002-05-19 00:14:50 +00:00
|
|
|
KASSERT(td == curthread, ("%s: td not curthread", __func__));
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
|
|
|
if (td->td_proc == p)
|
2001-10-07 20:06:03 +00:00
|
|
|
return (0);
|
2022-01-21 15:29:17 +00:00
|
|
|
if ((error = priv_check(td, PRIV_DEBUG_UNPRIV)))
|
|
|
|
return (error);
|
2002-05-19 00:14:50 +00:00
|
|
|
if ((error = prison_check(td->td_ucred, p->p_ucred)))
|
2001-02-21 06:39:57 +00:00
|
|
|
return (error);
|
2002-07-31 00:48:24 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_proc_check_debug(td->td_ucred, p)))
|
2002-07-31 00:48:24 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
|
Break out the "see_other_uids" policy check from the various
method-based inter-process security checks. To do this, introduce
a new cr_seeotheruids(u1, u2) function, which encapsulates the
"see_other_uids" logic. Call out to this policy following the
jail security check for all of {debug,sched,see,signal} inter-process
checks. This more consistently enforces the check, and makes the
check easy to modify. Eventually, it may be that this check should
become a MAC policy, loaded via a module.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
2002-03-22 02:28:26 +00:00
|
|
|
return (error);
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
|
2003-11-17 20:20:53 +00:00
|
|
|
return (error);
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
|
2001-08-28 16:35:33 +00:00
|
|
|
/*
|
2002-05-19 00:14:50 +00:00
|
|
|
* Is p's group set a subset of td's effective group set? This
|
|
|
|
* includes p's egid, group access list, rgid, and svgid.
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
*/
|
|
|
|
grpsubset = 1;
|
2002-05-19 00:14:50 +00:00
|
|
|
for (i = 0; i < p->p_ucred->cr_ngroups; i++) {
|
|
|
|
if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) {
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
grpsubset = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
grpsubset = grpsubset &&
|
2002-05-19 00:14:50 +00:00
|
|
|
groupmember(p->p_ucred->cr_rgid, td->td_ucred) &&
|
|
|
|
groupmember(p->p_ucred->cr_svgid, td->td_ucred);
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
|
|
|
|
/*
|
2002-05-19 00:14:50 +00:00
|
|
|
* Are the uids present in p's credential equal to td's
|
|
|
|
* effective uid? This includes p's euid, svuid, and ruid.
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
*/
|
2002-05-19 00:14:50 +00:00
|
|
|
uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid &&
|
|
|
|
td->td_ucred->cr_uid == p->p_ucred->cr_svuid &&
|
|
|
|
td->td_ucred->cr_uid == p->p_ucred->cr_ruid);
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
|
|
|
|
/*
|
2002-05-19 00:14:50 +00:00
|
|
|
* If p's gids aren't a subset, or the uids aren't a subset,
|
o Introduce group subset test, which limits the ability of a process to
debug another process based on their respective {effective,additional,
saved,real} gid's. p1 is only permitted to debug p2 if its effective
gids (egid + additional groups) are a strict superset of the gids of
p2. This implements properly the security test previously incorrectly
implemented in kern_ktrace.c, and is consistent with the kernel
security policy (although might be slightly confusing for those more
familiar with the userland policy).
o Restructure p_candebug() logic so that various results are generated
comparing uids, gids, credential changes, and then composed in a
single check before testing for privilege. These tests encapsulate
the "BSD" inter-process debugging policy. Other non-BSD checks remain
seperate. Additional comments are added.
Submitted by: tmm, rwatson
Obtained from: TrustedBSD Project
Reviewed by: petef, tmm, rwatson
2001-11-02 18:44:50 +00:00
|
|
|
* or the credential has changed, require appropriate privilege
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
* for td to debug p.
|
2001-08-28 16:35:33 +00:00
|
|
|
*/
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
if (!grpsubset || !uidsubset) {
|
2007-06-12 00:12:01 +00:00
|
|
|
error = priv_check(td, PRIV_DEBUG_DIFFCRED);
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
2023-01-31 00:15:04 +00:00
|
|
|
/*
|
|
|
|
* Has the credential of the process changed since the last exec()?
|
|
|
|
*/
|
|
|
|
if ((p->p_flag & P_SUGID) != 0) {
|
2007-06-12 00:12:01 +00:00
|
|
|
error = priv_check(td, PRIV_DEBUG_SUGID);
|
2001-10-09 16:56:29 +00:00
|
|
|
if (error)
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
return (error);
|
2001-08-28 16:35:33 +00:00
|
|
|
}
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
|
2001-12-02 15:07:10 +00:00
|
|
|
/* Can't trace init when securelevel > 0. */
|
2002-05-19 00:14:50 +00:00
|
|
|
if (p == initproc) {
|
|
|
|
error = securelevel_gt(td->td_ucred, 0);
|
2001-09-18 21:03:53 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
}
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
|
2001-11-02 16:41:06 +00:00
|
|
|
/*
|
|
|
|
* Can't trace a process that's currently exec'ing.
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
*
|
2001-11-02 16:41:06 +00:00
|
|
|
* XXX: Note, this is not a security policy decision, it's a
|
|
|
|
* basic correctness/functionality decision. Therefore, this check
|
|
|
|
* should be moved to the caller's of p_candebug().
|
|
|
|
*/
|
2002-05-19 00:14:50 +00:00
|
|
|
if ((p->p_flag & P_INEXEC) != 0)
|
2008-12-12 12:06:28 +00:00
|
|
|
return (EBUSY);
|
2001-12-06 21:58:47 +00:00
|
|
|
|
2022-04-09 06:53:17 +00:00
|
|
|
/* Denied explicitly */
|
2015-01-18 15:13:11 +00:00
|
|
|
if ((p->p_flag2 & P2_NOTRACE) != 0) {
|
|
|
|
error = priv_check(td, PRIV_DEBUG_DENIED);
|
|
|
|
if (error != 0)
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
o Centralize inter-process access control, introducing:
int p_can(p1, p2, operation, privused)
which allows specification of subject process, object process,
inter-process operation, and an optional call-by-reference privused
flag, allowing the caller to determine if privilege was required
for the call to succeed. This allows jail, kern.ps_showallprocs and
regular credential-based interaction checks to occur in one block of
code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a
series of static function checks in kern_prot, which should not
be invoked directly.
o Commented out capabilities entries are included for some checks.
o Update most inter-process authorization to make use of p_can() instead
of manual checks, PRISON_CHECK(), P_TRESPASS(), and
kern.ps_showallprocs.
o Modify suser{,_xxx} to use const arguments, as it no longer modifies
process flags due to the disabling of ASU.
o Modify some checks/errors in procfs so that ENOENT is returned instead
of ESRCH, further improving concealment of processes that should not
be visible to other processes. Also introduce new access checks to
improve hiding of processes for procfs_lookup(), procfs_getattr(),
procfs_readdir(). Correct a bug reported by bp concerning not
handling the CREATE case in procfs_lookup(). Remove volatile flag in
procfs that caused apparently spurious qualifier warnigns (approved by
bde).
o Add comment noting that ktrace() has not been updated, as its access
control checks are different from ptrace(), whereas they should
probably be the same. Further discussion should happen on this topic.
Reviewed by: bde, green, phk, freebsd-security, others
Approved by: bde
Obtained from: TrustedBSD Project
2000-08-30 04:49:09 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2002-03-22 19:57:41 +00:00
|
|
|
* Determine whether the subject represented by cred can "see" a socket.
|
|
|
|
* Returns: 0 for permitted, ENOENT otherwise.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
cr_canseesocket(struct ucred *cred, struct socket *so)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = prison_check(cred, so->so_cred);
|
|
|
|
if (error)
|
|
|
|
return (ENOENT);
|
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
error = mac_socket_check_visible(cred, so);
|
2002-07-31 00:48:24 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
2002-03-22 19:57:41 +00:00
|
|
|
#endif
|
2016-07-27 20:34:09 +00:00
|
|
|
if (cr_canseeotheruids(cred, so->so_cred))
|
2002-07-31 00:48:24 +00:00
|
|
|
return (ENOENT);
|
2016-07-27 20:34:09 +00:00
|
|
|
if (cr_canseeothergids(cred, so->so_cred))
|
2003-11-17 20:20:53 +00:00
|
|
|
return (ENOENT);
|
2002-03-22 19:57:41 +00:00
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2005-04-18 13:36:57 +00:00
|
|
|
* Determine whether td can wait for the exit of p.
|
|
|
|
* Returns: 0 for permitted, an errno value otherwise
|
|
|
|
* Locks: Sufficient locks to protect various components of td and p
|
|
|
|
* must be held. td must be curthread, and a lock must
|
|
|
|
* be held for p.
|
|
|
|
* References: td and p must be valid for the lifetime of the call
|
|
|
|
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
p_canwait(struct thread *td, struct proc *p)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
|
|
|
|
KASSERT(td == curthread, ("%s: td not curthread", __func__));
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
2009-07-17 14:48:21 +00:00
|
|
|
if ((error = prison_check(td->td_ucred, p->p_ucred)))
|
2005-04-18 13:36:57 +00:00
|
|
|
return (error);
|
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_proc_check_wait(td->td_ucred, p)))
|
2005-04-18 13:36:57 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
|
|
|
#if 0
|
|
|
|
/* XXXMAC: This could have odd effects on some shells. */
|
2016-07-27 20:34:09 +00:00
|
|
|
if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
|
2005-04-18 13:36:57 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
/*
|
|
|
|
* Credential management.
|
|
|
|
*
|
|
|
|
* struct ucred objects are rarely allocated but gain and lose references all
|
|
|
|
* the time (e.g., on struct file alloc/dealloc) turning refcount updates into
|
|
|
|
* a significant source of cache-line ping ponging. Common cases are worked
|
|
|
|
* around by modifying thread-local counter instead if the cred to operate on
|
|
|
|
* matches td_realucred.
|
|
|
|
*
|
|
|
|
* The counter is split into 2 parts:
|
|
|
|
* - cr_users -- total count of all struct proc and struct thread objects
|
|
|
|
* which have given cred in p_ucred and td_ucred respectively
|
|
|
|
* - cr_ref -- the actual ref count, only valid if cr_users == 0
|
|
|
|
*
|
|
|
|
* If users == 0 then cr_ref behaves similarly to refcount(9), in particular if
|
|
|
|
* the count reaches 0 the object is freeable.
|
|
|
|
* If users > 0 and curthread->td_realucred == cred, then updates are performed
|
|
|
|
* against td_ucredref.
|
|
|
|
* In other cases updates are performed against cr_ref.
|
|
|
|
*
|
|
|
|
* Changing td_realucred into something else decrements cr_users and transfers
|
|
|
|
* accumulated updates.
|
|
|
|
*/
|
|
|
|
struct ucred *
|
|
|
|
crcowget(struct ucred *cr)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
cr->cr_users++;
|
|
|
|
cr->cr_ref++;
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
|
|
|
return (cr);
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct ucred *
|
|
|
|
crunuse(struct thread *td)
|
|
|
|
{
|
|
|
|
struct ucred *cr, *crold;
|
|
|
|
|
2020-08-01 16:02:32 +00:00
|
|
|
MPASS(td->td_realucred == td->td_ucred);
|
|
|
|
cr = td->td_realucred;
|
2020-06-09 23:03:48 +00:00
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
cr->cr_ref += td->td_ucredref;
|
|
|
|
td->td_ucredref = 0;
|
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
cr->cr_users--;
|
|
|
|
if (cr->cr_users == 0) {
|
2023-03-22 20:42:04 +00:00
|
|
|
KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p",
|
2020-06-09 23:03:48 +00:00
|
|
|
__func__, cr->cr_ref, cr));
|
|
|
|
crold = cr;
|
|
|
|
} else {
|
|
|
|
cr->cr_ref--;
|
|
|
|
crold = NULL;
|
|
|
|
}
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
2020-08-01 16:02:32 +00:00
|
|
|
td->td_realucred = NULL;
|
2020-06-09 23:03:48 +00:00
|
|
|
return (crold);
|
|
|
|
}
|
|
|
|
|
2020-11-14 19:22:02 +00:00
|
|
|
static void
|
|
|
|
crunusebatch(struct ucred *cr, int users, int ref)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(users > 0, ("%s: passed users %d not > 0 ; cred %p",
|
|
|
|
__func__, users, cr));
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
KASSERT(cr->cr_users >= users, ("%s: users %d not > %d on cred %p",
|
|
|
|
__func__, cr->cr_users, users, cr));
|
|
|
|
cr->cr_users -= users;
|
|
|
|
cr->cr_ref += ref;
|
|
|
|
cr->cr_ref -= users;
|
|
|
|
if (cr->cr_users > 0) {
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
|
|
|
return;
|
|
|
|
}
|
2023-03-22 20:42:04 +00:00
|
|
|
KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p",
|
2020-11-14 19:22:02 +00:00
|
|
|
__func__, cr->cr_ref, cr));
|
|
|
|
if (cr->cr_ref > 0) {
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
crfree_final(cr);
|
|
|
|
}
|
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
void
|
|
|
|
crcowfree(struct thread *td)
|
|
|
|
{
|
|
|
|
struct ucred *cr;
|
|
|
|
|
|
|
|
cr = crunuse(td);
|
|
|
|
if (cr != NULL)
|
|
|
|
crfree(cr);
|
|
|
|
}
|
|
|
|
|
|
|
|
struct ucred *
|
|
|
|
crcowsync(void)
|
|
|
|
{
|
|
|
|
struct thread *td;
|
|
|
|
struct proc *p;
|
|
|
|
struct ucred *crnew, *crold;
|
|
|
|
|
|
|
|
td = curthread;
|
|
|
|
p = td->td_proc;
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
|
|
|
|
|
|
|
MPASS(td->td_realucred == td->td_ucred);
|
|
|
|
if (td->td_realucred == p->p_ucred)
|
|
|
|
return (NULL);
|
|
|
|
|
|
|
|
crnew = crcowget(p->p_ucred);
|
|
|
|
crold = crunuse(td);
|
|
|
|
td->td_realucred = crnew;
|
|
|
|
td->td_ucred = td->td_realucred;
|
|
|
|
return (crold);
|
|
|
|
}
|
|
|
|
|
2020-11-14 19:22:02 +00:00
|
|
|
/*
|
|
|
|
* Batching.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
credbatch_add(struct credbatch *crb, struct thread *td)
|
|
|
|
{
|
|
|
|
struct ucred *cr;
|
|
|
|
|
|
|
|
MPASS(td->td_realucred != NULL);
|
|
|
|
MPASS(td->td_realucred == td->td_ucred);
|
2021-02-18 10:25:10 +00:00
|
|
|
MPASS(TD_GET_STATE(td) == TDS_INACTIVE);
|
2020-11-14 19:22:02 +00:00
|
|
|
cr = td->td_realucred;
|
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
if (crb->cred != cr) {
|
|
|
|
if (crb->users > 0) {
|
|
|
|
MPASS(crb->cred != NULL);
|
|
|
|
crunusebatch(crb->cred, crb->users, crb->ref);
|
|
|
|
crb->users = 0;
|
|
|
|
crb->ref = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
crb->cred = cr;
|
|
|
|
crb->users++;
|
|
|
|
crb->ref += td->td_ucredref;
|
|
|
|
td->td_ucredref = 0;
|
|
|
|
td->td_realucred = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
credbatch_final(struct credbatch *crb)
|
|
|
|
{
|
|
|
|
|
|
|
|
MPASS(crb->cred != NULL);
|
|
|
|
MPASS(crb->users > 0);
|
|
|
|
crunusebatch(crb->cred, crb->users, crb->ref);
|
|
|
|
}
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Allocate a zeroed cred structure.
|
|
|
|
*/
|
|
|
|
struct ucred *
|
2002-04-01 20:13:31 +00:00
|
|
|
crget(void)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2017-05-17 00:34:34 +00:00
|
|
|
struct ucred *cr;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2008-10-23 15:53:51 +00:00
|
|
|
cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO);
|
2020-06-09 23:03:48 +00:00
|
|
|
mtx_init(&cr->cr_mtx, "cred", NULL, MTX_DEF);
|
|
|
|
cr->cr_ref = 1;
|
2007-06-07 22:27:15 +00:00
|
|
|
#ifdef AUDIT
|
|
|
|
audit_cred_init(cr);
|
|
|
|
#endif
|
2002-07-31 00:39:19 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
mac_cred_init(cr);
|
2002-07-31 00:39:19 +00:00
|
|
|
#endif
|
2014-11-05 02:08:37 +00:00
|
|
|
cr->cr_groups = cr->cr_smallgroups;
|
|
|
|
cr->cr_agroups =
|
|
|
|
sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]);
|
1994-05-24 10:09:53 +00:00
|
|
|
return (cr);
|
|
|
|
}
|
|
|
|
|
2000-11-30 19:09:48 +00:00
|
|
|
/*
|
2001-08-28 16:35:33 +00:00
|
|
|
* Claim another reference to a ucred structure.
|
2000-11-30 19:09:48 +00:00
|
|
|
*/
|
2001-10-11 23:38:17 +00:00
|
|
|
struct ucred *
|
2002-04-01 20:13:31 +00:00
|
|
|
crhold(struct ucred *cr)
|
2000-11-30 19:09:48 +00:00
|
|
|
{
|
2020-06-09 23:03:48 +00:00
|
|
|
struct thread *td;
|
|
|
|
|
|
|
|
td = curthread;
|
|
|
|
if (__predict_true(td->td_realucred == cr)) {
|
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
td->td_ucredref++;
|
|
|
|
return (cr);
|
|
|
|
}
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
cr->cr_ref++;
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
2001-10-11 23:38:17 +00:00
|
|
|
return (cr);
|
2000-11-30 19:09:48 +00:00
|
|
|
}
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
2007-03-04 22:36:48 +00:00
|
|
|
* Free a cred structure. Throws away space when ref count gets to 0.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
1994-05-25 09:21:21 +00:00
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
crfree(struct ucred *cr)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2020-06-09 23:03:48 +00:00
|
|
|
struct thread *td;
|
|
|
|
|
|
|
|
td = curthread;
|
2020-07-02 12:58:07 +00:00
|
|
|
if (__predict_true(td->td_realucred == cr)) {
|
2020-06-09 23:03:48 +00:00
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
td->td_ucredref--;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
KASSERT(cr->cr_users >= 0, ("%s: users %d not >= 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
cr->cr_ref--;
|
|
|
|
if (cr->cr_users > 0) {
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
|
|
|
return;
|
|
|
|
}
|
2023-03-22 20:42:04 +00:00
|
|
|
KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p",
|
2020-06-09 23:03:48 +00:00
|
|
|
__func__, cr->cr_ref, cr));
|
|
|
|
if (cr->cr_ref > 0) {
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
|
|
|
return;
|
|
|
|
}
|
2020-11-14 19:22:02 +00:00
|
|
|
crfree_final(cr);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
crfree_final(struct ucred *cr)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(cr->cr_users == 0, ("%s: users %d not == 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
2023-03-22 20:42:04 +00:00
|
|
|
KASSERT(cr->cr_ref == 0, ("%s: ref %ld not == 0 on cred %p",
|
2020-11-14 19:22:02 +00:00
|
|
|
__func__, cr->cr_ref, cr));
|
2020-11-19 04:28:39 +00:00
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
/*
|
|
|
|
* Some callers of crget(), such as nfs_statfs(), allocate a temporary
|
|
|
|
* credential, but don't allocate a uidinfo structure.
|
|
|
|
*/
|
|
|
|
if (cr->cr_uidinfo != NULL)
|
|
|
|
uifree(cr->cr_uidinfo);
|
|
|
|
if (cr->cr_ruidinfo != NULL)
|
|
|
|
uifree(cr->cr_ruidinfo);
|
|
|
|
if (cr->cr_prison != NULL)
|
|
|
|
prison_free(cr->cr_prison);
|
|
|
|
if (cr->cr_loginclass != NULL)
|
|
|
|
loginclass_free(cr->cr_loginclass);
|
2007-06-07 22:27:15 +00:00
|
|
|
#ifdef AUDIT
|
2020-06-09 23:03:48 +00:00
|
|
|
audit_cred_destroy(cr);
|
2007-06-07 22:27:15 +00:00
|
|
|
#endif
|
2002-07-31 00:39:19 +00:00
|
|
|
#ifdef MAC
|
2020-06-09 23:03:48 +00:00
|
|
|
mac_cred_destroy(cr);
|
2002-07-31 00:39:19 +00:00
|
|
|
#endif
|
2020-06-09 23:03:48 +00:00
|
|
|
mtx_destroy(&cr->cr_mtx);
|
|
|
|
if (cr->cr_groups != cr->cr_smallgroups)
|
|
|
|
free(cr->cr_groups, M_CRED);
|
|
|
|
free(cr, M_CRED);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
2001-10-11 23:38:17 +00:00
|
|
|
/*
|
|
|
|
* Copy a ucred's contents from a template. Does not block.
|
|
|
|
*/
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
crcopy(struct ucred *dest, struct ucred *src)
|
2001-10-11 23:38:17 +00:00
|
|
|
{
|
|
|
|
|
2014-10-05 02:16:53 +00:00
|
|
|
KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred"));
|
2001-10-11 23:38:17 +00:00
|
|
|
bcopy(&src->cr_startcopy, &dest->cr_startcopy,
|
2001-12-02 15:07:10 +00:00
|
|
|
(unsigned)((caddr_t)&src->cr_endcopy -
|
2001-10-11 23:38:17 +00:00
|
|
|
(caddr_t)&src->cr_startcopy));
|
2023-03-22 20:42:04 +00:00
|
|
|
dest->cr_flags = src->cr_flags;
|
2009-06-19 17:10:35 +00:00
|
|
|
crsetgroups(dest, src->cr_ngroups, src->cr_groups);
|
2001-10-11 23:38:17 +00:00
|
|
|
uihold(dest->cr_uidinfo);
|
|
|
|
uihold(dest->cr_ruidinfo);
|
2009-05-27 14:11:23 +00:00
|
|
|
prison_hold(dest->cr_prison);
|
2011-03-05 12:40:35 +00:00
|
|
|
loginclass_hold(dest->cr_loginclass);
|
2007-06-07 22:27:15 +00:00
|
|
|
#ifdef AUDIT
|
|
|
|
audit_cred_copy(src, dest);
|
|
|
|
#endif
|
2002-07-31 00:39:19 +00:00
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
mac_cred_copy(src, dest);
|
2002-07-31 00:39:19 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Dup cred struct to a new held one.
|
|
|
|
*/
|
|
|
|
struct ucred *
|
2002-04-01 20:13:31 +00:00
|
|
|
crdup(struct ucred *cr)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
|
|
|
struct ucred *newcr;
|
|
|
|
|
2001-10-11 23:38:17 +00:00
|
|
|
newcr = crget();
|
|
|
|
crcopy(newcr, cr);
|
1994-05-24 10:09:53 +00:00
|
|
|
return (newcr);
|
|
|
|
}
|
|
|
|
|
2002-02-27 04:45:37 +00:00
|
|
|
/*
|
|
|
|
* Fill in a struct xucred based on a struct ucred.
|
|
|
|
*/
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
cru2x(struct ucred *cr, struct xucred *xcr)
|
2002-02-27 04:45:37 +00:00
|
|
|
{
|
2009-06-19 17:10:35 +00:00
|
|
|
int ngroups;
|
2002-02-27 04:45:37 +00:00
|
|
|
|
|
|
|
bzero(xcr, sizeof(*xcr));
|
|
|
|
xcr->cr_version = XUCRED_VERSION;
|
|
|
|
xcr->cr_uid = cr->cr_uid;
|
2009-06-19 17:10:35 +00:00
|
|
|
|
|
|
|
ngroups = MIN(cr->cr_ngroups, XU_NGROUPS);
|
|
|
|
xcr->cr_ngroups = ngroups;
|
|
|
|
bcopy(cr->cr_groups, xcr->cr_groups,
|
|
|
|
ngroups * sizeof(*cr->cr_groups));
|
2002-02-27 04:45:37 +00:00
|
|
|
}
|
|
|
|
|
2019-05-30 16:11:20 +00:00
|
|
|
void
|
2019-05-30 14:24:26 +00:00
|
|
|
cru2xt(struct thread *td, struct xucred *xcr)
|
|
|
|
{
|
|
|
|
|
|
|
|
cru2x(td->td_ucred, xcr);
|
|
|
|
xcr->cr_pid = td->td_proc->p_pid;
|
|
|
|
}
|
|
|
|
|
2015-03-21 20:24:54 +00:00
|
|
|
/*
|
|
|
|
* Set initial process credentials.
|
|
|
|
* Callers are responsible for providing the reference for provided credentials.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
proc_set_cred_init(struct proc *p, struct ucred *newcred)
|
|
|
|
{
|
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
p->p_ucred = crcowget(newcred);
|
2015-03-21 20:24:54 +00:00
|
|
|
}
|
|
|
|
|
2015-03-16 00:10:03 +00:00
|
|
|
/*
|
|
|
|
* Change process credentials.
|
2015-03-21 20:24:54 +00:00
|
|
|
* Callers are responsible for providing the reference for passed credentials
|
2015-03-16 00:10:03 +00:00
|
|
|
* and for freeing old ones.
|
|
|
|
*
|
|
|
|
* Process has to be locked except when it does not have credentials (as it
|
|
|
|
* should not be visible just yet) or when newcred is NULL (as this can be
|
|
|
|
* only used when the process is about to be freed, at which point it should
|
|
|
|
* not be visible anymore).
|
|
|
|
*/
|
2019-12-14 00:43:17 +00:00
|
|
|
void
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(struct proc *p, struct ucred *newcred)
|
|
|
|
{
|
2020-06-09 23:03:48 +00:00
|
|
|
struct ucred *cr;
|
2015-03-16 00:10:03 +00:00
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
cr = p->p_ucred;
|
|
|
|
MPASS(cr != NULL);
|
2020-05-25 12:41:44 +00:00
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
2020-06-09 23:03:48 +00:00
|
|
|
KASSERT(newcred->cr_users == 0, ("%s: users %d not 0 on cred %p",
|
|
|
|
__func__, newcred->cr_users, newcred));
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
cr->cr_users--;
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
2015-03-16 00:10:03 +00:00
|
|
|
p->p_ucred = newcred;
|
2020-06-09 23:03:48 +00:00
|
|
|
newcred->cr_users = 1;
|
2020-05-25 12:41:44 +00:00
|
|
|
PROC_UPDATE_COW(p);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proc_unset_cred(struct proc *p)
|
|
|
|
{
|
|
|
|
struct ucred *cr;
|
|
|
|
|
2020-06-09 23:03:48 +00:00
|
|
|
MPASS(p->p_state == PRS_ZOMBIE || p->p_state == PRS_NEW);
|
2020-05-25 12:41:44 +00:00
|
|
|
cr = p->p_ucred;
|
|
|
|
p->p_ucred = NULL;
|
2020-06-09 23:03:48 +00:00
|
|
|
KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
|
|
|
|
__func__, cr->cr_users, cr));
|
|
|
|
mtx_lock(&cr->cr_mtx);
|
|
|
|
cr->cr_users--;
|
|
|
|
if (cr->cr_users == 0)
|
2023-03-22 20:42:04 +00:00
|
|
|
KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p",
|
2020-06-09 23:03:48 +00:00
|
|
|
__func__, cr->cr_ref, cr));
|
|
|
|
mtx_unlock(&cr->cr_mtx);
|
2020-05-25 12:41:44 +00:00
|
|
|
crfree(cr);
|
2015-03-16 00:10:03 +00:00
|
|
|
}
|
|
|
|
|
2009-06-19 17:10:35 +00:00
|
|
|
struct ucred *
|
|
|
|
crcopysafe(struct proc *p, struct ucred *cr)
|
|
|
|
{
|
|
|
|
struct ucred *oldcred;
|
|
|
|
int groups;
|
|
|
|
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
|
|
|
|
|
|
|
oldcred = p->p_ucred;
|
|
|
|
while (cr->cr_agroups < oldcred->cr_agroups) {
|
|
|
|
groups = oldcred->cr_agroups;
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
crextend(cr, groups);
|
|
|
|
PROC_LOCK(p);
|
|
|
|
oldcred = p->p_ucred;
|
|
|
|
}
|
|
|
|
crcopy(cr, oldcred);
|
|
|
|
|
|
|
|
return (oldcred);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Extend the passed in credential to hold n items.
|
|
|
|
*/
|
2016-01-14 10:16:25 +00:00
|
|
|
void
|
2009-06-19 17:10:35 +00:00
|
|
|
crextend(struct ucred *cr, int n)
|
|
|
|
{
|
|
|
|
int cnt;
|
|
|
|
|
|
|
|
/* Truncate? */
|
|
|
|
if (n <= cr->cr_agroups)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We extend by 2 each time since we're using a power of two
|
|
|
|
* allocator until we need enough groups to fill a page.
|
|
|
|
* Once we're allocating multiple pages, only allocate as many
|
|
|
|
* as we actually need. The case of processes needing a
|
|
|
|
* non-power of two number of pages seems more likely than
|
|
|
|
* a real world process that adds thousands of groups one at a
|
|
|
|
* time.
|
|
|
|
*/
|
|
|
|
if ( n < PAGE_SIZE / sizeof(gid_t) ) {
|
|
|
|
if (cr->cr_agroups == 0)
|
2020-01-14 02:14:02 +00:00
|
|
|
cnt = MAX(1, MINALLOCSIZE / sizeof(gid_t));
|
2009-06-19 17:10:35 +00:00
|
|
|
else
|
|
|
|
cnt = cr->cr_agroups * 2;
|
|
|
|
|
|
|
|
while (cnt < n)
|
|
|
|
cnt *= 2;
|
|
|
|
} else
|
|
|
|
cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t));
|
|
|
|
|
|
|
|
/* Free the old array. */
|
2014-11-05 02:08:37 +00:00
|
|
|
if (cr->cr_groups != cr->cr_smallgroups)
|
2009-06-19 17:10:35 +00:00
|
|
|
free(cr->cr_groups, M_CRED);
|
|
|
|
|
|
|
|
cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO);
|
|
|
|
cr->cr_agroups = cnt;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2009-06-20 20:29:21 +00:00
|
|
|
* Copy groups in to a credential, preserving any necessary invariants.
|
|
|
|
* Currently this includes the sorting of all supplemental gids.
|
|
|
|
* crextend() must have been called before hand to ensure sufficient
|
|
|
|
* space is available.
|
2009-06-19 17:10:35 +00:00
|
|
|
*/
|
|
|
|
static void
|
|
|
|
crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups)
|
|
|
|
{
|
2009-06-20 20:29:21 +00:00
|
|
|
int i;
|
|
|
|
int j;
|
|
|
|
gid_t g;
|
2020-09-01 22:12:32 +00:00
|
|
|
|
2009-06-19 17:10:35 +00:00
|
|
|
KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small"));
|
|
|
|
|
|
|
|
bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t));
|
|
|
|
cr->cr_ngroups = ngrp;
|
2009-06-20 20:29:21 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Sort all groups except cr_groups[0] to allow groupmember to
|
|
|
|
* perform a binary search.
|
|
|
|
*
|
|
|
|
* XXX: If large numbers of groups become common this should
|
|
|
|
* be replaced with shell sort like linux uses or possibly
|
|
|
|
* heap sort.
|
|
|
|
*/
|
|
|
|
for (i = 2; i < ngrp; i++) {
|
|
|
|
g = cr->cr_groups[i];
|
|
|
|
for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--)
|
|
|
|
cr->cr_groups[j + 1] = cr->cr_groups[j];
|
|
|
|
cr->cr_groups[j + 1] = g;
|
|
|
|
}
|
2009-06-19 17:10:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Copy groups in to a credential after expanding it if required.
|
2010-01-12 07:49:34 +00:00
|
|
|
* Truncate the list to (ngroups_max + 1) if it is too large.
|
2009-06-19 17:10:35 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
crsetgroups(struct ucred *cr, int ngrp, gid_t *groups)
|
|
|
|
{
|
|
|
|
|
2010-01-12 07:49:34 +00:00
|
|
|
if (ngrp > ngroups_max + 1)
|
|
|
|
ngrp = ngroups_max + 1;
|
2009-06-19 17:10:35 +00:00
|
|
|
|
|
|
|
crextend(cr, ngrp);
|
|
|
|
crsetgroups_locked(cr, ngrp, groups);
|
|
|
|
}
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Get login name, if available.
|
|
|
|
*/
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct getlogin_args {
|
|
|
|
char *namebuf;
|
|
|
|
u_int namelen;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_getlogin(struct thread *td, struct getlogin_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2002-02-23 11:12:57 +00:00
|
|
|
char login[MAXLOGNAME];
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
2014-11-04 23:29:29 +00:00
|
|
|
size_t len;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-03-03 22:46:16 +00:00
|
|
|
if (uap->namelen > MAXLOGNAME)
|
1997-03-03 23:02:43 +00:00
|
|
|
uap->namelen = MAXLOGNAME;
|
2002-02-23 11:12:57 +00:00
|
|
|
PROC_LOCK(p);
|
|
|
|
SESS_LOCK(p->p_session);
|
2014-11-04 23:29:29 +00:00
|
|
|
len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1;
|
2002-02-23 11:12:57 +00:00
|
|
|
SESS_UNLOCK(p->p_session);
|
|
|
|
PROC_UNLOCK(p);
|
2014-11-04 23:29:29 +00:00
|
|
|
if (len > uap->namelen)
|
2012-11-14 10:32:12 +00:00
|
|
|
return (ERANGE);
|
2014-11-04 23:29:29 +00:00
|
|
|
return (copyout(login, uap->namebuf, len));
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Set login name.
|
|
|
|
*/
|
1995-11-12 06:43:28 +00:00
|
|
|
#ifndef _SYS_SYSPROTO_H_
|
1994-05-24 10:09:53 +00:00
|
|
|
struct setlogin_args {
|
|
|
|
char *namebuf;
|
|
|
|
};
|
1995-11-12 06:43:28 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
/* ARGSUSED */
|
1994-05-25 09:21:21 +00:00
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_setlogin(struct thread *td, struct setlogin_args *uap)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-09-12 08:38:13 +00:00
|
|
|
struct proc *p = td->td_proc;
|
1994-05-24 10:09:53 +00:00
|
|
|
int error;
|
1997-03-03 10:15:48 +00:00
|
|
|
char logintmp[MAXLOGNAME];
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2014-11-04 23:29:29 +00:00
|
|
|
CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp));
|
|
|
|
|
2007-06-12 00:12:01 +00:00
|
|
|
error = priv_check(td, PRIV_PROC_SETLOGIN);
|
2002-04-13 23:07:05 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
2002-06-29 01:50:25 +00:00
|
|
|
error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL);
|
2014-11-04 23:29:29 +00:00
|
|
|
if (error != 0) {
|
|
|
|
if (error == ENAMETOOLONG)
|
|
|
|
error = EINVAL;
|
|
|
|
return (error);
|
2002-02-23 11:12:57 +00:00
|
|
|
}
|
2016-08-20 20:28:08 +00:00
|
|
|
AUDIT_ARG_LOGIN(logintmp);
|
2014-11-04 23:29:29 +00:00
|
|
|
PROC_LOCK(p);
|
|
|
|
SESS_LOCK(p->p_session);
|
|
|
|
strcpy(p->p_session->s_login, logintmp);
|
|
|
|
SESS_UNLOCK(p->p_session);
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
return (0);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
1997-12-20 03:05:47 +00:00
|
|
|
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
setsugid(struct proc *p)
|
1997-12-20 03:05:47 +00:00
|
|
|
{
|
2002-06-18 22:41:35 +00:00
|
|
|
|
|
|
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
1997-12-20 03:05:47 +00:00
|
|
|
p->p_flag |= P_SUGID;
|
|
|
|
}
|
2000-09-05 22:11:13 +00:00
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's effective uid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
2000-09-05 22:11:13 +00:00
|
|
|
*/
|
|
|
|
void
|
2002-06-19 06:39:25 +00:00
|
|
|
change_euid(struct ucred *newcred, struct uidinfo *euip)
|
2000-09-05 22:11:13 +00:00
|
|
|
{
|
|
|
|
|
2002-06-19 06:39:25 +00:00
|
|
|
newcred->cr_uid = euip->ui_uid;
|
|
|
|
uihold(euip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
uifree(newcred->cr_uidinfo);
|
2002-06-19 06:39:25 +00:00
|
|
|
newcred->cr_uidinfo = euip;
|
2000-09-05 22:11:13 +00:00
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's effective gid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_gid will be modified.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
2000-09-05 22:11:13 +00:00
|
|
|
*/
|
2000-10-26 15:49:35 +00:00
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
change_egid(struct ucred *newcred, gid_t egid)
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
newcred->cr_groups[0] = egid;
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's real uid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo
|
|
|
|
* will be updated, and the old and new cr_ruidinfo proc
|
|
|
|
* counts will be updated.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
|
|
|
*/
|
|
|
|
void
|
2002-06-19 06:39:25 +00:00
|
|
|
change_ruid(struct ucred *newcred, struct uidinfo *ruip)
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
(void)chgproccnt(newcred->cr_ruidinfo, -1, 0);
|
2002-06-19 06:39:25 +00:00
|
|
|
newcred->cr_ruid = ruip->ui_uid;
|
|
|
|
uihold(ruip);
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
uifree(newcred->cr_ruidinfo);
|
2002-06-19 06:39:25 +00:00
|
|
|
newcred->cr_ruidinfo = ruip;
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
(void)chgproccnt(newcred->cr_ruidinfo, 1, 0);
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's real gid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_rgid will be updated.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
|
|
|
*/
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
change_rgid(struct ucred *newcred, gid_t rgid)
|
2000-09-05 22:11:13 +00:00
|
|
|
{
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
|
|
|
|
newcred->cr_rgid = rgid;
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's saved uid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_svuid will be updated.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
|
|
|
*/
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
change_svuid(struct ucred *newcred, uid_t svuid)
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
newcred->cr_svuid = svuid;
|
|
|
|
}
|
|
|
|
|
2010-07-18 20:57:53 +00:00
|
|
|
/*-
|
2001-08-28 16:35:33 +00:00
|
|
|
* Change a process's saved gid.
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
* Side effects: newcred->cr_svgid will be updated.
|
|
|
|
* References: newcred must be an exclusive credential reference for the
|
|
|
|
* duration of the call.
|
|
|
|
*/
|
|
|
|
void
|
2002-04-01 20:13:31 +00:00
|
|
|
change_svgid(struct ucred *newcred, gid_t svgid)
|
o Merge contents of struct pcred into struct ucred. Specifically, add the
real uid, saved uid, real gid, and saved gid to ucred, as well as the
pcred->pc_uidinfo, which was associated with the real uid, only rename
it to cr_ruidinfo so as not to conflict with cr_uidinfo, which
corresponds to the effective uid.
o Remove p_cred from struct proc; add p_ucred to struct proc, replacing
original macro that pointed.
p->p_ucred to p->p_cred->pc_ucred.
o Universally update code so that it makes use of ucred instead of pcred,
p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo,
cr_{r,sv}{u,g}id instead of p_*, etc.
o Remove pcred0 and its initialization from init_main.c; initialize
cr_ruidinfo there.
o Restruction many credential modification chunks to always crdup while
we figure out locking and optimizations; generally speaking, this
means moving to a structure like this:
newcred = crdup(oldcred);
...
p->p_ucred = newcred;
crfree(oldcred);
It's not race-free, but better than nothing. There are also races
in sys_process.c, all inter-process authorization, fork, exec, and
exit.
o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid;
remove comments indicating that the old arrangement was a problem.
o Restructure exec1() a little to use newcred/oldcred arrangement, and
use improved uid management primitives.
o Clean up exit1() so as to do less work in credential cleanup due to
pcred removal.
o Clean up fork1() so as to do less work in credential cleanup and
allocation.
o Clean up ktrcanset() to take into account changes, and move to using
suser_xxx() instead of performing a direct uid==0 comparision.
o Improve commenting in various kern_prot.c credential modification
calls to better document current behavior. In a couple of places,
current behavior is a little questionable and we need to check
POSIX.1 to make sure it's "right". More commenting work still
remains to be done.
o Update credential management calls, such as crfree(), to take into
account new ruidinfo reference.
o Modify or add the following uid and gid helper routines:
change_euid()
change_egid()
change_ruid()
change_rgid()
change_svuid()
change_svgid()
In each case, the call now acts on a credential not a process, and as
such no longer requires more complicated process locking/etc. They
now assume the caller will do any necessary allocation of an
exclusive credential reference. Each is commented to document its
reference requirements.
o CANSIGIO() is simplified to require only credentials, not processes
and pcreds.
o Remove lots of (p_pcred==NULL) checks.
o Add an XXX to authorization code in nfs_lock.c, since it's
questionable, and needs to be considered carefully.
o Simplify posix4 authorization code to require only credentials, not
processes and pcreds. Note that this authorization, as well as
CANSIGIO(), needs to be updated to use the p_cansignal() and
p_cansched() centralized authorization routines, as they currently
do not take into account some desirable restrictions that are handled
by the centralized routines, as well as being inconsistent with other
similar authorization instances.
o Update libkvm to take these changes into account.
Obtained from: TrustedBSD Project
Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
2001-05-25 16:59:11 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
newcred->cr_svgid = svgid;
|
2000-09-05 22:11:13 +00:00
|
|
|
}
|
2022-01-21 21:52:35 +00:00
|
|
|
|
|
|
|
bool allow_ptrace = true;
|
|
|
|
SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace, CTLFLAG_RWTUN,
|
|
|
|
&allow_ptrace, 0,
|
|
|
|
"Deny ptrace(2) use by returning ENOSYS");
|